# Encrypting Ansible Playbook

**URL:** <https://forum.ansible.com/t/encrypting-ansible-playbook/29075>\
**Category:** Ansible Project\
**Created:** [November 20, 2018, 10:26am UTC](https://forum.ansible.com/t/encrypting-ansible-playbook/29075 "2018-11-20T10:26:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sandeep\_Kandhway](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@Sandeep\_Kandhway](https://forum.ansible.com/u/Sandeep_Kandhway)\
**Post date:** [November 20, 2018, 10:26am UTC](https://forum.ansible.com/t/encrypting-ansible-playbook/29075/1 "2018-11-20T10:26:39Z")

</div>

Hi Experts,

I have prepared an Ansible Playbook. However I want to encrypt the plabook in such a way that the end user to whom I’ll be providing the playbook will have only the privilege to run the playbook and not to view its contents. With Vault I can encrypt this but again to run the playbook I need to provide the vault password. With this password the code can automatically be decrypted very easily. Is there any way to achieve this.

Thanks,  
Sandeep

---

<div class="post-metadata">

**Author:** ![Ameya\_Agashe](https://avatars.discourse-cdn.com/v4/letter/a/54ee81/32.png) [@Ameya\_Agashe](https://forum.ansible.com/u/Ameya_Agashe)\
**Post date:** [November 20, 2018, 10:29am UTC](https://forum.ansible.com/t/encrypting-ansible-playbook/29075/2 "2018-11-20T10:29:30Z")

</div>

Very good question, I also wonder if this is indeed possible?

Kind Regards,  
Ameya Agashe

---

<div class="post-metadata">

**Author:** ![Sandeep\_Kandhway](https://avatars.discourse-cdn.com/v4/letter/s/ba8739/32.png) [@Sandeep\_Kandhway](https://forum.ansible.com/u/Sandeep_Kandhway)\
**Post date:** [November 20, 2018, 11:52am UTC](https://forum.ansible.com/t/encrypting-ansible-playbook/29075/3 "2018-11-20T11:52:52Z")

</div>

Please let me know for any updates.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [November 20, 2018, 2:30pm UTC](https://forum.ansible.com/t/encrypting-ansible-playbook/29075/4 "2018-11-20T14:30:38Z")

</div>

Instead of providing the vault password allow execution of a vault  
script that will query/generate the password after it verifies it is  
being called from ansible-playbook (so user cannot call directly).

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [November 20, 2018, 4:27pm UTC](https://forum.ansible.com/t/encrypting-ansible-playbook/29075/5 "2018-11-20T16:27:02Z")

</div>

hi

Could you tell us what the rationale is for such a requirement?  
I can understand some sort of integrity checks to make sure content hasn’t been tampered with or isn’t damaged.  
But it sounds counter intuitive to run something that has been deliberately obfuscated.  
So please enlighten us.

Dick

---

<div class="post-metadata">

**Author:** ![Jonathan\_Lozada\_De\_L](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@Jonathan\_Lozada\_De\_L](https://forum.ansible.com/u/Jonathan_Lozada_De_L)\
**Post date:** [November 20, 2018, 4:36pm UTC](https://forum.ansible.com/t/encrypting-ansible-playbook/29075/6 "2018-11-20T16:36:14Z")

</div>

I would make the roles/playbook as modular as possible then have each user pass the necessary variables. If you want others to use credentials but, not see them then I suggest you use awx/tower.