How to encrypt ansible vault password

Archives Ansible Project
1

Hi All,

I am facing a challenge in getting CISO approval for my ansible project.
Issue: We are using Ansible vault for keeping vars secret. However, that vault password we are keeping it in ./ path in clear text.Can we encrypt the vault password itself.

Please assist me on this ,

Thanks in advance.

2

Hi, interesting question.
I suggest you two approaches:
1)

  • Apply strict ACL on the vault password file (like 0400 for e.g.)
  • Do not version the file
  • rekey it frequently

Make use of an external or third party secret manager tool to store the vault password and get access to it through a script.

Regards.

3

Hi Stefim,

Thanks for your reponse.Much appritaite !

regarding the third party, we tried that. We used one password to store it, but while ansible taking that password from 1password, it’s fetching in cleartext.

4

Eventually ansible needs the plain text