# Is there a task/module to create a vaulted file?

**URL:** <https://forum.ansible.com/t/is-there-a-task-module-to-create-a-vaulted-file/38797>\
**Category:** Ansible Project\
**Created:** [May 28, 2024, 1:17pm UTC](https://forum.ansible.com/t/is-there-a-task-module-to-create-a-vaulted-file/38797 "2024-05-28T13:17:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [May 28, 2024, 1:17pm UTC](https://forum.ansible.com/t/is-there-a-task-module-to-create-a-vaulted-file/38797/1 "2024-05-28T13:17:45Z")

</div>

Hii

In one of my playbooks there is a task that is creating a token through an API.  
As the next task, I would like to store that token somewhere in my vars hierarchy.  
If it were a plain text variable that would be easy.

But I don’t seem to be able to safe a vaulted file with a task.

One approach is with the pipe lookup and ansible-vault encrypt (seems a big ugly/unsafe):

- name: save token

ansible.builtin.copy:  
content: “{{ lookup(‘ansible.builtin.pipe’, ‘echo ’ ~ token|quote ~ ’ ansible-vault encrypt’) }}”  
dest: /tmp/out1  
mode: 0600

This seems to work, and because ansible.cfg contains the right information (vault\_identity\_list, vault\_encrypt\_identity) the encrypted content looks good, when I’m debugging.  
But the actual file contents are plain text again. It seems the copy module decrypts the encrypted content again? How can I force the content to NOT be decrypted?

Another approach is the vault filter, which seems to be a bit cleaner. I thought this would do the trick:

- name: save token

ansible.builtin.copy:  
content: “{{ token | ansible.builtin.vault }}”  
dest: /tmp/out2  
mode: 0600

But that didn’t work, the filter insists on an actual secret value. I then must do a separate lookup for the ansible vault password. But the vault password file can also be an executable that sends the secret to stdout. I don’t want to have to implement that logic myself.

Is there a way for the ansible.builtin.vault filter to use the vault\_identity\_list and vault\_encrypt\_identity that are in ansible.cfg?

To see if it worked at all, i just hard coded the actual secret like this:

- name: save token

ansible.builtin.copy:  
content: “{{ token | ansible.builtin.vault(‘hackme’) }}”  
dest: /tmp/out2  
mode: 0600

Just like the other example, this works but the content is again decrypted by the copy module.

Any hints are appreciated 🙂

tnx

Dick

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [May 28, 2024, 1:23pm UTC](https://forum.ansible.com/t/is-there-a-task-module-to-create-a-vaulted-file/38797/2 "2024-05-28T13:23:03Z")

</div>

> This seems to work, and because ansible.cfg contains the right information (vault\_identity\_list, vault\_encrypt\_identity) the encrypted content looks good, when I’m debugging.  
> But the actual file contents are plain text again. It seems the copy module decrypts the encrypted content again? How can I force the content to NOT be decrypted?

To quickly answer my own question: there is a decrypt parameter: [https://docs.ansible.com/ansible/latest/collections/ansible/builtin/copy\_module.html#parameter-decrypt](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/copy_module.html#parameter-decrypt)  
I had never noticed that 🤡

So the first task does work now.

Still my other question remains:

---

<div class="post-metadata">

**Author:** ![Andrew\_Latham](https://avatars.discourse-cdn.com/v4/letter/a/ed8c4c/32.png) [@Andrew\_Latham](https://forum.ansible.com/u/Andrew_Latham)\
**Post date:** [May 28, 2024, 1:42pm UTC](https://forum.ansible.com/t/is-there-a-task-module-to-create-a-vaulted-file/38797/3 "2024-05-28T13:42:04Z")

</div>

Unable to test from current location but do you need to delegate\_to for this?

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [May 28, 2024, 2:18pm UTC](https://forum.ansible.com/t/is-there-a-task-module-to-create-a-vaulted-file/38797/4 "2024-05-28T14:18:10Z")

</div>

Yes, I didn’t explicitly mention it, but I’m running all the tasks from a dedicated “local” play with these settings:

- name: API tasks  
hosts: foo\_hosts

# This is an API-only play, so we run it locally - not from the actual hosts

connection: local  
become: false  
gather\_facts: false  
tags: foo,always  
run\_once: true

tasks:

- name: blah  
…

---

<div class="post-metadata">

**Author:** ![Andrew\_Latham](https://avatars.discourse-cdn.com/v4/letter/a/ed8c4c/32.png) [@Andrew\_Latham](https://forum.ansible.com/u/Andrew_Latham)\
**Post date:** [May 28, 2024, 3:23pm UTC](https://forum.ansible.com/t/is-there-a-task-module-to-create-a-vaulted-file/38797/5 "2024-05-28T15:23:20Z")

</div>

I saw [https://github.com/ansible/ansible/pull/79864](https://github.com/ansible/ansible/pull/79864) which is related. I am interested in this as it sounds useful to many. I wildly assume the solution is obvious. Maybe drop the token into a local dir and a later task can encrypt any files found in said dir and copy them to the vars dir of your choice.