# How to handle passwords with the vault

**URL:** <https://forum.ansible.com/t/how-to-handle-passwords-with-the-vault/23211>\
**Category:** Ansible Project\
**Created:** [December 9, 2016, 11:59am UTC](https://forum.ansible.com/t/how-to-handle-passwords-with-the-vault/23211 "2016-12-09T11:59:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dave\_B](https://avatars.discourse-cdn.com/v4/letter/d/f08c70/32.png) [@Dave\_B](https://forum.ansible.com/u/Dave_B)\
**Post date:** [December 9, 2016, 11:59am UTC](https://forum.ansible.com/t/how-to-handle-passwords-with-the-vault/23211/1 "2016-12-09T11:59:32Z")

</div>

I’m using Ansible to orchestrate a bunch of VM, as expected. I want to run commands as root, so I have the root password in a file in group\_vars, so /etc/ansible/group\_vars/vault, which I’ve encrypted with ansible-vault.

I understand from the Best Practices [http://docs.ansible.com/ansible/playbooks\_best\_practices.html#best-practices-for-variables-and-vaults](http://docs.ansible.com/ansible/playbooks_best_practices.html#best-practices-for-variables-and-vaults) that I’m to use a file containing the passwords that’s encrypted and then another referencing those. So I have  
group\_vars → vault  
 → vars

cat vars  
ansible\_become\_user=vault\_ansible\_become\_user  
ansible\_become\_pass=vault\_ansible\_become\_pass

And then those variables are assigned in vault.

I’m totally not sure how then to use these or reference them. Any advice/guidance would be good.

Thanks

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [December 12, 2016, 1:46pm UTC](https://forum.ansible.com/t/how-to-handle-passwords-with-the-vault/23211/2 "2016-12-12T13:46:32Z")

</div>

I think the think you are missing here is that whatever is in group\_vars (either a file or a directory) needs to match up with the name of a group in your inventory file (unless you using the magic ‘all’ group, which applies to all hosts).

So you might wind up with 3 files in different directories like this

group\_vars/development/vault  
group\_vars/testing/vault

group\_vars/production/vault

then in your inventory all the variables in  
group\_vars/development/vault  
would apply to any hosts belonging to a group called

[development]  
host1  
host2

You’d then need to encrypt them like this:

ansible-vault encrypt group\_vars/development/vault  
ansible-vault encrypt group\_vars/testing/vault

ansible-vault encrypt group\_vars/production/vault

You can use the vaulted variables anywhere you can use ordinary variables, but you’ll need to supply the vault password to your playbook runs (or you can specify a path to a file containing the vault password in your ansible.cfg file if that makes sense for you).

Jon