# How to  do password management

**URL:** <https://forum.ansible.com/t/how-to-do-password-management/23213>\
**Category:** Ansible Project\
**Created:** [December 9, 2016, 12:30pm UTC](https://forum.ansible.com/t/how-to-do-password-management/23213 "2016-12-09T12:30:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dave\_B](https://avatars.discourse-cdn.com/v4/letter/d/f08c70/32.png) [@Dave\_B](https://forum.ansible.com/u/Dave_B)\
**Post date:** [December 9, 2016, 12:30pm UTC](https://forum.ansible.com/t/how-to-do-password-management/23213/1 "2016-12-09T12:30:13Z")

</div>

Hi

Struggling to get my head around this. According to the best practices, I’ve put the root password for all the vms in a vault encrypted file, and the variables are vault\_ prefixed as suggested in [http://docs.ansible.com/ansible/playbooks\_best\_practices.html#best-practices-for-variables-and-vaults](http://docs.ansible.com/ansible/playbooks_best_practices.html#best-practices-for-variables-and-vaults) . I don

My directory structure:  
ls /etc/ansible/group\_vars/

vars  
vault

cat vars  
ansible\_become\_user=vault\_ansible\_become\_user  
ansible\_become\_pass=vault\_ansible\_become\_pass

And vault contains the secure data, and is ansible-vault encrypted.

How do I then pull that into a playbook/command line argument?

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [February 10, 2017, 3:41am UTC](https://forum.ansible.com/t/how-to-do-password-management/23213/2 "2017-02-10T03:41:00Z")

</div>

The group\_vars/\* adjacent to inventory or play are automatically read,  
I would just set ansible\_become\_pass there.

Also note that these must be YAML formatted files, not KEY=VALUE pairs.