# Environment Variable as Vault Key

**URL:** <https://forum.ansible.com/t/environment-variable-as-vault-key/40837>\
**Category:** Get Help\
**Tags:** ansible-vault\
**Created:** [March 6, 2025, 7:48pm UTC](https://forum.ansible.com/t/environment-variable-as-vault-key/40837 "2025-03-06T19:48:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![AquaMCU](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/aquamcu/32/7825_2.png) [@AquaMCU](https://forum.ansible.com/u/AquaMCU)\
**Post date:** [March 6, 2025, 7:48pm UTC](https://forum.ansible.com/t/environment-variable-as-vault-key/40837/1 "2025-03-06T19:48:28Z")

</div>

Hi Ansible community.

I want to use ansible vault. Since I do not want to store my vault key in a file and I do not want to type it in every time I run a playbook, I wonder, if I can do this:

Store the vault key in an environment variable for example ANSIBLE\_VAULT\_KEY  
This gets used everytime I run a playbook. When I am finished, I close the session or empty the variable.

What do you think? Is it possible? That would speed up my workflow and make my installation much faster.

Oliver

---

<div class="post-metadata">

**Author:** ![kristianheljas](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kristianheljas/32/7702_2.png) [@kristianheljas](https://forum.ansible.com/u/kristianheljas)\
**Post date:** [March 6, 2025, 8:07pm UTC](https://forum.ansible.com/t/environment-variable-as-vault-key/40837/2 "2025-03-06T20:07:11Z")

</div>

I don’t think there’s builtin way, but you can achieve this using [vault client scripts](https://docs.ansible.com/ansible/latest/vault_guide/vault_managing_passwords.html#storing-passwords-in-third-party-tools-with-vault-password-client-scripts)

Create new file `vault-passphrase-client.sh`, with following content:

```sh
#!/usr/bin/env sh
echo "$ANSIBLE_VAULT_PASSPHRASE"

```

Make it executable and pass it with `--vault-password-file=vault-passphrase-client.sh` or add following to your ansible.cfg:

```auto
[defaults]
vault_password_file = ./vault-passphrase-client.sh

```

Side note, i have also written small script to use GPG to decrypt my passphrase from disk. See [this gist](https://gist.github.com/kristianheljas/d7cbfbed592e358fbf8b523486a119e8#file-vault-gpg-client-sh)

On first run it will generate random 128 character key and store it encrypted for recipients in the ANSIBLE\_VAULT\_PASSPHRASE\_RECIPIENTS enviroment variable at `.vault-passhrase.gpg`.  
Later os will prompt me for the gpg key passphrase once and subsequent runs it’s cached.

You can also manually create passphrase file with your own, like so:

```auto
echo "secure-password" | gpg2 --encrypt --armor --output vault-passphrase.gpg --recipient me@example.com

```

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [March 6, 2025, 8:22pm UTC](https://forum.ansible.com/t/environment-variable-as-vault-key/40837/3 "2025-03-06T20:22:28Z")

</div>

> [@kristianheljas](#):
>
> I don’t think there’s builtin way, but you can achieve this using [vault client scripts](https://docs.ansible.com/ansible/latest/vault_guide/vault_managing_passwords.html#storing-passwords-in-third-party-tools-with-vault-password-client-scripts)

This is the way ❤

---

<div class="post-metadata">

**Author:** ![binbashroot](https://avatars.discourse-cdn.com/v4/letter/b/ad7895/32.png) [@binbashroot](https://forum.ansible.com/u/binbashroot)\
**Post date:** [March 7, 2025, 12:31am UTC](https://forum.ansible.com/t/environment-variable-as-vault-key/40837/4 "2025-03-07T00:31:59Z")

</div>

Let me refer you to this article:

> **[How to encrypt Bash shell variables with Ansible Vault](https://www.redhat.com/en/blog/ansible-vault-bash-encrypt)**
>
> Ansible is a great tool to automate mundane or complex tasks. It also allows code reuse by passing variables to roles or collections. This is important when ...

---

<div class="post-metadata">

**Author:** ![AquaMCU](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/aquamcu/32/7825_2.png) [@AquaMCU](https://forum.ansible.com/u/AquaMCU)\
**Post date:** [March 10, 2025, 11:27am UTC](https://forum.ansible.com/t/environment-variable-as-vault-key/40837/5 "2025-03-10T11:27:48Z")

</div>

Superb. I just implemented this and it works like a charm!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [April 9, 2025, 11:28am UTC](https://forum.ansible.com/t/environment-variable-as-vault-key/40837/6 "2025-04-09T11:28:16Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.