# How to use vault with AWX? **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [September 14, 2017, 12:22pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482 "2017-09-14T12:22:47Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Jean-Francois\_Anctil](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@Jean-Francois\_Anctil](https://forum.ansible.com/u/Jean-Francois_Anctil)\ **Post date:** [September 14, 2017, 12:22pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482/1 "2017-09-14T12:22:47Z")
Hi, I have a vault.yml file and when I run a playbook from AWX that refers to a variable from the vault file, I got an error telling me that the variable can’t be found. How can I use a vault in AWX? ---
**Author:** ![matburt](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matburt/32/3612_2.png) [@matburt](https://forum.ansible.com/u/matburt)\ **Post date:** [September 14, 2017, 12:31pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482/2 "2017-09-14T12:31:33Z")
You’ll need to set up a vault credential and associate it with the job template that you are running. ---
**Author:** ![Jean-Francois\_Anctil](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@Jean-Francois\_Anctil](https://forum.ansible.com/u/Jean-Francois_Anctil)\ **Post date:** [September 14, 2017, 12:35pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482/3 "2017-09-14T12:35:58Z")
I forgot to mention it, but I already have the vault credential setted up and associated to my job template. Is there a precise folder where I should put the vault.yml file? For now, I have put it in the group\_vars/all subdirectory of my inventory. Is it OK? ---
**Author:** ![matburt](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/matburt/32/3612_2.png) [@matburt](https://forum.ansible.com/u/matburt)\ **Post date:** [September 14, 2017, 1:11pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482/4 "2017-09-14T13:11:31Z")
All you should need to do is stick it in a location that ansible would normally load vars from. Or if that’s not possible, include it directly. ---
**Author:** ![Jean-Francois\_Anctil](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@Jean-Francois\_Anctil](https://forum.ansible.com/u/Jean-Francois_Anctil)\ **Post date:** [September 14, 2017, 1:24pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482/5 "2017-09-14T13:24:11Z")
What do you mean “include it directly”? Since I am able to run my playbooks manually on the server, it means that my vault.yml is loaded… Here is the output from AWX: TASK [deploy\_scripts : Create the SSH private key file] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 09:18:56 77 fatal: [cls1-labo-04.capitale.qc.ca]: FAILED! =\> {“failed”: true, “msg”: “the field ‘args’ has an invalid value, which appears to include a variable that is undefined. The error was: ‘vault\_auto\_it\_bitbucket\_private\_key’ is undefined\n\nThe error appears to have been in ‘/var/lib/awx/projects/\_6\_\_conformite/roles/deploy\_scripts/tasks/deploy\_scripts.yml’: line 68, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Create the SSH private key file\n ^ here\n”} And here is the validation that the variable exists in the vault.yml file: ansible-vault view /data/jfanctil/projects/ansible-inventory/inventories/group\_vars/all/vault.yml| grep vault\_auto\_it\_bitbucket\_private\_key Vault password: vault\_auto\_it\_bitbucket\_private\_key: | What am I doing wrong? ---
**Author:** ![Jean-Francois\_Anctil](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@Jean-Francois\_Anctil](https://forum.ansible.com/u/Jean-Francois_Anctil)\ **Post date:** [September 14, 2017, 1:34pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482/6 "2017-09-14T13:34:54Z")
FYI: my setup is like this: I have 2 projects: one for my playbooks and one for my inventory. So, my template is bind to the playbooks’s project and my vault.yml resides in the inventory’s project. Could it be the problem? ---
**Author:** ![Christopher\_Meyers](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Christopher\_Meyers](https://forum.ansible.com/u/Christopher_Meyers)\ **Post date:** [September 14, 2017, 1:50pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482/7 "2017-09-14T13:50:24Z")
Yep, the two project setup is a problem for your use case. The vault file needs to live in the same repo as your playbook. Once you do that, you can use a machine credential, associated with your job template, that contains your vault password. [http://docs.ansible.com/ansible-tower/latest/html/userguide/credentials.html#machine](http://docs.ansible.com/ansible-tower/latest/html/userguide/credentials.html#machine) ---
**Author:** ![Bill\_Nottingham1](https://avatars.discourse-cdn.com/v4/letter/b/58f4c7/32.png) [@Bill\_Nottingham1](https://forum.ansible.com/u/Bill_Nottingham1)\ **Post date:** [September 14, 2017, 2:21pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482/8 "2017-09-14T14:21:18Z")
Jean-Francois Anctil (anctil.jeff@gmail.com) said: > I forgot to mention it, but I already have the vault credential setted up > and associated to my job template. Is there a precise folder where I should > put the vault.yml file? For now, I have put it in the group\_vars/all > subdirectory of my inventory. Is it OK? Are you using inventory from a project? Inventory from a project does not currently support vaulted variables. Bill ---
**Author:** ![Jean-Francois\_Anctil](https://avatars.discourse-cdn.com/v4/letter/j/13edae/32.png) [@Jean-Francois\_Anctil](https://forum.ansible.com/u/Jean-Francois_Anctil)\ **Post date:** [September 14, 2017, 2:52pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482/9 "2017-09-14T14:52:43Z")
Yes, that’s what I am using, because I didn’t find a way to retrieve my inventory from a on-premise git repository. The only options available for sources are “solutions” one. Our inventory is stored in a git repository and that’s why I used a project to retrieve it… Do you have another idea on how we should do it? ---
**Author:** ![raf.nijskens.hgst](https://avatars.discourse-cdn.com/v4/letter/r/f04885/32.png) [@raf.nijskens.hgst](https://forum.ansible.com/u/raf.nijskens.hgst)\ **Post date:** [September 24, 2017, 6:28pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482/10 "2017-09-24T18:28:05Z")
It works when running it manually: awx-manage inventory\_import --inventory-id={{id}} --source inventory/ --overwrite --overwrite-vars If you have a local ansible.cfg with the setting for vaultpassword-file it will actually use that. Unfortunately, this makes it is no longer a dynamic inventory. ---
**Author:** ![AlanCoding](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/alancoding/32/301_2.png) [@AlanCoding](https://forum.ansible.com/u/AlanCoding)\ **Post date:** [September 25, 2017, 12:00pm UTC](https://forum.ansible.com/t/how-to-use-vault-with-awx/25482/11 "2017-09-25T12:00:32Z")
It sounds like your question comes down to this enhancement issue that we have open. [https://github.com/ansible/awx/issues/223](https://github.com/ansible/awx/issues/223) The need for this is new with the introduction of SCM-based inventory, and ansible-inventory allows for it. I’m very excited about adding this, but we still need to pass through the data in a secure way from the code that runs the task to the inventory import management command. So there is work to be done. Until that’s done, you might also be able to accomplish your overall goal using the custom credential type injection methods - you save your secret data in a credential, and use it in the script. Alan