# How to decrypt the AWX vault password **URL:** \ **Category:** Get Help\ **Tags:** awx\ **Created:** [March 22, 2024, 5:32pm UTC](https://forum.ansible.com/t/how-to-decrypt-the-awx-vault-password/4520 "2024-03-22T17:32:33Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![ashok453](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ashok453/32/2660_2.png) [@ashok453](https://forum.ansible.com/u/ashok453)\ **Post date:** [March 22, 2024, 5:32pm UTC](https://forum.ansible.com/t/how-to-decrypt-the-awx-vault-password/4520/1 "2024-03-22T17:32:33Z")
Is there a way to decrypt the AWX Vault password that is encrypted if the copy of plain-text password is lost. We somehow need to decrypt it first as it is the master password using which we encrypted all our playbooks. We are not using any password file in the configuration We have 2 types of credentials 1)Credential type -Vault which was used to encrypt vault password 2)ssh keys of cateogry Machine type to encrypt private key We need to somehow reset or decrypt the vault password to decrypt ssh keys Also where can I find ansible.cfg as my ansible running as docker instance in AWX ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [March 22, 2024, 6:54pm UTC](https://forum.ansible.com/t/how-to-decrypt-the-awx-vault-password/4520/2 "2024-03-22T18:54:21Z")
First, I want to preface that AWX is _not_ a Secrets Manager. It does have a Secrets Vault, and it integrates well with external SM’s, but it doesn’t provide you with any direct way to expose its stored secrets. It isn’t meant to be used that way. Second, AWX doesn’t provide any way to retrieve encrypted secrets as plaintext, but in some cases you can deliberately expose them in a carefully constructed playbook that echos the variables to stdout. However, there isn’t a way to expose the Vault password secret itself as plaintext as far as I can tell. Ansible doesn’t provide a way to do that, and AWX sends it as an stdin reply to `--ask-vault-pass` on job invocation; so there’s no variable or even a vault-password-file to expose. Now, provided that you still have the vault password saved as an AWX Credential, you can expose your ansible-vaulted secrets in your playbooks like I described above to recover them, and re-encrypt them under a new and known vault password (store this in a proper external Secrets Manager!). If you have already modified or deleted that vault credential in AWX, then you’re probably SoL. If you have routine backups of the Postgres DB, you might be able to restore an old backup to restore the credential, but you would still need to decrypt/re-encrypt your secrets with a new and known vault password. Edit: If you don’t know the password because it was created by an ex-employee, then there may be some hope in a little forensics. They might have created a vault-password-file and saved it somewhere on their linux work computer, and then pointed to it in ansible.cfg (or if they only passed as cli, that might be visible in their bash history). ---
**Author:** ![ashok453](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ashok453/32/2660_2.png) [@ashok453](https://forum.ansible.com/u/ashok453)\ **Post date:** [March 23, 2024, 4:42am UTC](https://forum.ansible.com/t/how-to-decrypt-the-awx-vault-password/4520/3 "2024-03-23T04:42:30Z")
Thanks That is right.The people who implemented this 3yrs ago are no longer with the company and I have recently joined this project. ---
**Author:** ![Klaas](https://avatars.discourse-cdn.com/v4/letter/k/ecc23a/32.png) [@Klaas](https://forum.ansible.com/u/Klaas)\ **Post date:** [March 24, 2024, 7:55pm UTC](https://forum.ansible.com/t/how-to-decrypt-the-awx-vault-password/4520/4 "2024-03-24T19:55:46Z")
if it’s saved in awx you can decrypt it [awx/docs/credentials/extract\_credentials.md at devel · ansible/awx · GitHub](https://github.com/ansible/awx/blob/devel/docs/credentials/extract_credentials.md) ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [March 25, 2024, 2:19pm UTC](https://forum.ansible.com/t/how-to-decrypt-the-awx-vault-password/4520/5 "2024-03-25T14:19:06Z")
Good find! I don’t know how I missed that. ---
**Author:** ![ashok453](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ashok453/32/2660_2.png) [@ashok453](https://forum.ansible.com/u/ashok453)\ **Post date:** [March 28, 2024, 5:15pm UTC](https://forum.ansible.com/t/how-to-decrypt-the-awx-vault-password/4520/6 "2024-03-28T17:15:19Z")
Apologies for late reply. I can’t find awx-manage command. Btw our awx envrionment is running on docker instances .I tried to install awx-mange from the repos (RHEL8) but can’t find it. ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [March 28, 2024, 5:18pm UTC](https://forum.ansible.com/t/how-to-decrypt-the-awx-vault-password/4520/7 "2024-03-28T17:18:53Z")
`awx-manage` will be inside of an awx-task container. You will need to exec into the container to do this. Edit: something like this: `docker exec -it awx-task /bin/bash -c "awx-manage shell_plus"` ---
**Author:** ![ashok453](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ashok453/32/2660_2.png) [@ashok453](https://forum.ansible.com/u/ashok453)\ **Post date:** [April 1, 2024, 11:26am UTC](https://forum.ansible.com/t/how-to-decrypt-the-awx-vault-password/4520/8 "2024-04-01T11:26:25Z")
Thanks @Denney-tech @Klaas . I’m able to retrieve the key which was of credential type “Machine” but trying to retrieve vault password which is failing. Can you help with me the command to retrieve the encrypted credentials of type “Vault” as well as “Source Control” ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [April 1, 2024, 2:35pm UTC](https://forum.ansible.com/t/how-to-decrypt-the-awx-vault-password/4520/9 "2024-04-01T14:35:31Z")
I created a “fake vault credential” object in my AWX 23.8.1 instance and was able to retreive the vault password with the following: ```python >>> from awx.main.utils import decrypt_field >>> print(decrypt_field(Credential.objects.get(name="fake vault credential"), "vault_password")) vault_foo_bar ``` Edit: for Source Control, I was similarly able to get the SSH Private Key, but there’s no passwords for my SCM so those fields are null. ```python >>> from awx.main.utils import decrypt_field >>> print(decrypt_field(Credential.objects.get(name="Github - username"), "ssh_key_data")) ``` To see what fields are available, save your credential object to a var first. ```python >>> from awx.main.utils import decrypt_field >>> foo_credential = Credential.objects.get(name="Github - username") >>> foo_credential.display_inputs() {'username': '', 'ssh_key_data': '$encrypted$'} >>> print(decrypt_field(foo_credential, "ssh_key_data")) ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [May 1, 2024, 2:36pm UTC](https://forum.ansible.com/t/how-to-decrypt-the-awx-vault-password/4520/10 "2024-05-01T14:36:26Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.