# Dynamically include vaulted vars within playbook only for certain hosts

**URL:** <https://forum.ansible.com/t/dynamically-include-vaulted-vars-within-playbook-only-for-certain-hosts/23791>\
**Category:** Ansible Project\
**Created:** [February 21, 2017, 5:47pm UTC](https://forum.ansible.com/t/dynamically-include-vaulted-vars-within-playbook-only-for-certain-hosts/23791 "2017-02-21T17:47:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pete\_Albrecht](https://avatars.discourse-cdn.com/v4/letter/p/34f0e0/32.png) [@Pete\_Albrecht](https://forum.ansible.com/u/Pete_Albrecht)\
**Post date:** [February 21, 2017, 5:47pm UTC](https://forum.ansible.com/t/dynamically-include-vaulted-vars-within-playbook-only-for-certain-hosts/23791/1 "2017-02-21T17:47:04Z")

</div>

Greetings!

I’m trying to figure out the best way to dynamically include vaulted vars files in a playbook only for certain hosts. The situation is I’m building out production and pre-prod environments from a common playbook, including development (via vagrant) where the vault password will not be available. The vault password wont be distributed anywhere except for the build box. I tried using group\_vars, but the problem I run into is ansible tries to decrypt vars files for other hosts when running the playbook in dev where the vault password is not available. The only work-around I could find is to make a task or role that sets those variables using set\_fact, and only including that task in the hosts that need it. I’m wondering if there is a better way or if I’m doing it wrong.

`

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [February 28, 2017, 4:25pm UTC](https://forum.ansible.com/t/dynamically-include-vaulted-vars-within-playbook-only-for-certain-hosts/23791/2 "2017-02-28T16:25:37Z")

</div>

To include variables, use include\_vars, not include (this only works  
for plays or tasks).

Include\_vars is always dynamic, so you just need a when:

&nbsp;&nbsp;&nbsp;&nbsp;- include\_vars: vault\_vars/ci\_prod/vault.yml  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;when: myenv != 'dev'

# example when condition