# Do decrypted variables get copied to the host?

**URL:** <https://forum.ansible.com/t/do-decrypted-variables-get-copied-to-the-host/19199>\
**Category:** Ansible Project\
**Created:** [September 7, 2015, 10:22pm UTC](https://forum.ansible.com/t/do-decrypted-variables-get-copied-to-the-host/19199 "2015-09-07T22:22:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tom\_Paine1](https://avatars.discourse-cdn.com/v4/letter/t/3da27b/32.png) [@Tom\_Paine1](https://forum.ansible.com/u/Tom_Paine1)\
**Post date:** [September 7, 2015, 10:22pm UTC](https://forum.ansible.com/t/do-decrypted-variables-get-copied-to-the-host/19199/1 "2015-09-07T22:22:43Z")

</div>

After decrypting a vault and running a task using that vault data:

- Do only the variables involved in that task get copied to the host or do all decrypted variables get copied (even temporarily)?

If all get copied, do group\_vars restrict that copy only to the hosts in that group?

---

<div class="post-metadata">

**Author:** ![Igor\_Homyakov](https://avatars.discourse-cdn.com/v4/letter/i/f4b2a3/32.png) [@Igor\_Homyakov](https://forum.ansible.com/u/Igor_Homyakov)\
**Post date:** [September 8, 2015, 6:06am UTC](https://forum.ansible.com/t/do-decrypted-variables-get-copied-to-the-host/19199/2 "2015-09-08T06:06:37Z")

</div>

Hi Tom,

Only the variables involved in that task get copied to the host. You  
can set the environment variable ANSIBLE\_KEEP\_REMOTE\_FILES=1 on the  
controlling host to prevent ansible from deleting the remote files so  
you can check that by yourself.

-- Best, Igor

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [September 8, 2015, 1:26pm UTC](https://forum.ansible.com/t/do-decrypted-variables-get-copied-to-the-host/19199/3 "2015-09-08T13:26:30Z")

</div>

So ... depends, data passed to a task is normally copied with the task  
to the remote machines so the task can be executed there. If using the  
ssh connection plugin with pipelining, the data never gets copied to  
disk and gets read from a pipe and is only present in memory. When  
copied to the disk it is normally removed right after execution  
(unless using ANSIBLE\_KEEP\_REMOTE\_FILES=1, which should also disable  
pipelining).