# Is \`--vault-password-file\` on demand, does the script get executed every time an encrypted file is loaded, or just once at the start?

**URL:** <https://forum.ansible.com/t/is-vault-password-file-on-demand-does-the-script-get-executed-every-time-an-encrypted-file-is-loaded-or-just-once-at-the-start/2293>\
**Category:** Get Help\
**Created:** [November 10, 2023, 4:29pm UTC](https://forum.ansible.com/t/is-vault-password-file-on-demand-does-the-script-get-executed-every-time-an-encrypted-file-is-loaded-or-just-once-at-the-start/2293 "2023-11-10T16:29:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![KoenDG](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/koendg/32/1494_2.png) [@KoenDG](https://forum.ansible.com/u/KoenDG)\
**Post date:** [November 10, 2023, 4:29pm UTC](https://forum.ansible.com/t/is-vault-password-file-on-demand-does-the-script-get-executed-every-time-an-encrypted-file-is-loaded-or-just-once-at-the-start/2293/1 "2023-11-10T16:29:30Z")

</div>

I’m trying to work with more than 1 encrypted file and it seems the `--vault-password-file` option, which can take a script, only gets executed once.

Am I wrong in this? I’ve tried setting environment variables to pass along, if I execute the script manually it gets the correct password, but if I do `include_vars` on an encrypted file, it only works the first time, regardless of what I try.

Is this expected behavior? Do I need to provide a `--vault-id` per vault password I want to use during a playbook run?

---

<div class="post-metadata">

**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\
**Post date:** [November 10, 2023, 8:32pm UTC](https://forum.ansible.com/t/is-vault-password-file-on-demand-does-the-script-get-executed-every-time-an-encrypted-file-is-loaded-or-just-once-at-the-start/2293/2 "2023-11-10T20:32:50Z")

</div>

The program specified as `--vault-password-file` is invoked once only per playbook run, hence the limitation that `--vault-password-file` or `--ask-vault-pass` can only work with a single password.

If you need to run a play with differently vaulted files (i.e. vaulted with different passwords), then vault IDs are the way to go.

---

<div class="post-metadata">

**Author:** ![KoenDG](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/koendg/32/1494_2.png) [@KoenDG](https://forum.ansible.com/u/KoenDG)\
**Post date:** [November 10, 2023, 10:10pm UTC](https://forum.ansible.com/t/is-vault-password-file-on-demand-does-the-script-get-executed-every-time-an-encrypted-file-is-loaded-or-just-once-at-the-start/2293/3 "2023-11-10T22:10:41Z")

</div>

Thanks, I wanted to be sure.

I tried running `ansible-playbook` with `-vvvvv` and the output there seemed open to interpretation.

It claims to have a default vault password and then mentions this default is a script and that’s it in terms of output.

That doesn’t make it clear to me if the script will be executed on demand, or only at startup.

So again, thanks for clarifying.