# How to list the required vault ids for playing a playbook, like list-tags and list-tasks **URL:** \ **Category:** Get Help\ **Tags:** playbook\ **Created:** [September 24, 2025, 1:47pm UTC](https://forum.ansible.com/t/how-to-list-the-required-vault-ids-for-playing-a-playbook-like-list-tags-and-list-tasks/44552 "2025-09-24T13:47:29Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![gzm55](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gzm55/32/9405_2.png) [@gzm55](https://forum.ansible.com/u/gzm55)\ **Post date:** [September 24, 2025, 1:47pm UTC](https://forum.ansible.com/t/how-to-list-the-required-vault-ids-for-playing-a-playbook-like-list-tags-and-list-tasks/44552/1 "2025-09-24T13:47:30Z")
how to list the required vault ids for playing a playbook, like list-tags and list-tasks? ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [September 24, 2025, 3:39pm UTC](https://forum.ansible.com/t/how-to-list-the-required-vault-ids-for-playing-a-playbook-like-list-tags-and-list-tasks/44552/2 "2025-09-24T15:39:35Z")
There is no such feature currently. The only way to really know if a given string can decrypt an `ansible-vault`ed value is to try to decrypt the data with it. The vault header of more recently vaulted data contains the name of the vault password that was used to vault the data. For example, `$ANSIBLE_VAULT;1.2;AES256;guess_me` would be at the top of any data vaulted with the vault password stored in the file `guess_me` (or labeled `guess_me` if environment variables were used instead of files). So perhaps the simple answer is to recursively grep for vault headers: ```sh $ grep -r '\$ANSIBLE_VAULT;' . ``` While that may be sufficient for vaulted data contained within a project, it can’t find vaulted data in other parts of the file system or on remote hosts. ---
**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\ **Post date:** [September 24, 2025, 4:34pm UTC](https://forum.ansible.com/t/how-to-list-the-required-vault-ids-for-playing-a-playbook-like-list-tags-and-list-tasks/44552/3 "2025-09-24T16:34:18Z")
also note that ‘vault-id’ is just an optional label to allow users to track secrets, it is not required and even allowed to be omitted at any point, it will act as a preference if it matches, but it is not deterministic. ---
**Author:** ![flowerysong](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/flowerysong/32/2305_2.png) [@flowerysong](https://forum.ansible.com/u/flowerysong)\ **Post date:** [September 24, 2025, 6:31pm UTC](https://forum.ansible.com/t/how-to-list-the-required-vault-ids-for-playing-a-playbook-like-list-tags-and-list-tasks/44552/4 "2025-09-24T18:31:57Z")
There is a [config flag to make decryption act a little more like you might naively expect](https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-vault-id-match), but it’s not the default behaviour. ---
**Author:** ![gzm55](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gzm55/32/9405_2.png) [@gzm55](https://forum.ansible.com/u/gzm55)\ **Post date:** [September 25, 2025, 12:22am UTC](https://forum.ansible.com/t/how-to-list-the-required-vault-ids-for-playing-a-playbook-like-list-tags-and-list-tasks/44552/5 "2025-09-25T00:22:07Z")
yes, i’ve enabled this flag. ---
**Author:** ![gzm55](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gzm55/32/9405_2.png) [@gzm55](https://forum.ansible.com/u/gzm55)\ **Post date:** [September 25, 2025, 12:28am UTC](https://forum.ansible.com/t/how-to-list-the-required-vault-ids-for-playing-a-playbook-like-list-tags-and-list-tasks/44552/6 "2025-09-25T00:28:44Z")
this should be a static analysis. The real marked vault-ids in the encrypted blocks from the current running playbooks are not possible listed via `grep`. Is this possible to implement in the ansible-core as a new feature? ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [September 25, 2025, 7:10pm UTC](https://forum.ansible.com/t/how-to-list-the-required-vault-ids-for-playing-a-playbook-like-list-tags-and-list-tasks/44552/7 "2025-09-25T19:10:39Z")
I’ve just posted a shell script to a gist on github — [Report configured Ansible Vault IDs and what vaulted blobs they can decrypt · GitHub](https://gist.github.com/utoddl/69ff0baa35b4170df8d1eec61563a1ac) — which may meet your needs. It uses all your configured Vault IDs and reports which (if any) can decrypt each of the `$ANSIBLE_VAULT;` blobs it finds in or below your current directory. I’d be interested to know if that helps, and if not why. Cheers! ---
**Author:** ![gzm55](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gzm55/32/9405_2.png) [@gzm55](https://forum.ansible.com/u/gzm55)\ **Post date:** [September 26, 2025, 2:59am UTC](https://forum.ansible.com/t/how-to-list-the-required-vault-ids-for-playing-a-playbook-like-list-tags-and-list-tasks/44552/8 "2025-09-26T02:59:33Z")
thanks very much! ---
**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\ **Post date:** [September 26, 2025, 3:20pm UTC](https://forum.ansible.com/t/how-to-list-the-required-vault-ids-for-playing-a-playbook-like-list-tags-and-list-tasks/44552/9 "2025-09-26T15:20:37Z")
Here’s a typical output from running [that gist](https://gist.github.com/utoddl/69ff0baa35b4170df8d1eec61563a1ac) (above): ```plaintext $ vault-id-report.sh # Configured Vault IDs and Files abvnk ~/.vaults/.vaultpass-abvnk devops ~/.vaults/.vaultpass-devops info ~/.vaults/.vaultpass-info qi ~/.vaults/.vaultpass # IDs decrypting discovered ANSIBLE_VAULT data qi ./group_vars/qi_chem/vars.yml:10-18 $ANSIBLE_VAULT;1.2;AES256;qi devops ./group_vars/qi_chem/vars.yml:21-26 $ANSIBLE_VAULT;1.2;AES256;devops abvnk ./group_vars/qi_chem/vars.yml:29-34 $ANSIBLE_VAULT;1.2;AES256;abvnk qi ./group_vars/qi_chem/vars.yml:37-45 $ANSIBLE_VAULT;1.2;AES256;qi qi ./group_vars/qi_chem_dev/vars.yml:207-213 $ANSIBLE_VAULT;1.2;AES256;qi ./group_vars/qi_chem_dev/vars.yml:217-223 $ANSIBLE_VAULT;1.2;AES256; info ./group_vars/qi_chem_dev/vars.yml:268-356 $ANSIBLE_VAULT;1.2;AES256;info qi ./group_vars/qi_chem_dev/vars.yml:493-659 $ANSIBLE_VAULT;1.2;AES256;qi qi ./group_vars/qi_chem_prd/vars.yml:207-213 $ANSIBLE_VAULT;1.2;AES256;qi qi ./group_vars/qi_chem_prd/vars.yml:217-223 $ANSIBLE_VAULT;1.2;AES256;qi info ./group_vars/qi_chem_prd/vars.yml:267-355 $ANSIBLE_VAULT;1.2;AES256; devops ./group_vars/qi_chem_prd/vars.yml:492-658 $ANSIBLE_VAULT;1.2;AES256;devops qi ./group_vars/qi_chem_tst/vars.yml:207-213 $ANSIBLE_VAULT;1.2;AES256;qi qi ./group_vars/qi_chem_tst/vars.yml:217-223 $ANSIBLE_VAULT;1.2;AES256;qi abvnk ./group_vars/qi_chem_tst/vars.yml:268-356 $ANSIBLE_VAULT;1.2;AES256; qi ./group_vars/qi_chem_tst/vars.yml:493-659 $ANSIBLE_VAULT;1.2;AES256; ```