# Lookup vault in memory

**URL:** <https://forum.ansible.com/t/lookup-vault-in-memory/31691>\
**Category:** Ansible Project\
**Created:** [November 20, 2019, 12:47pm UTC](https://forum.ansible.com/t/lookup-vault-in-memory/31691 "2019-11-20T12:47:19Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Quentin\_Aveno](https://avatars.discourse-cdn.com/v4/letter/q/e9c0ed/32.png) [@Quentin\_Aveno](https://forum.ansible.com/u/Quentin_Aveno)\
**Post date:** [November 20, 2019, 12:47pm UTC](https://forum.ansible.com/t/lookup-vault-in-memory/31691/1 "2019-11-20T12:47:19Z")

</div>

Hi,  
I have a question about lookup and memory:  
When I use a lookup with vault, is the pass is store in memory when I use it directly in a task or pass it through a variable in an inventory ? Is there a significant difference ?

Have a nice day.

---

<div class="post-metadata">

**Author:** ![Quentin\_Aveno](https://avatars.discourse-cdn.com/v4/letter/q/e9c0ed/32.png) [@Quentin\_Aveno](https://forum.ansible.com/u/Quentin_Aveno)\
**Post date:** [November 20, 2019, 1:09pm UTC](https://forum.ansible.com/t/lookup-vault-in-memory/31691/2 "2019-11-20T13:09:01Z")

</div>

For more information :  
I’m concerned about security issue in my company where the continous delivery is share between many teams. I would like to not store secret in memory or at least the shortest possible time. I supposed that if I use my lookup directly in task and not in a variable I was safer. Am I right ?

---

<div class="post-metadata">

**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\
**Post date:** [November 20, 2019, 1:44pm UTC](https://forum.ansible.com/t/lookup-vault-in-memory/31691/3 "2019-11-20T13:44:24Z")

</div>

There is no difference because of "Lazy Evaluation" ("Ansible evaluates any  
variables in playbook content at the last possible second."), I think. See  
[https://docs.ansible.com/ansible/latest/reference\_appendices/glossary.html](https://docs.ansible.com/ansible/latest/reference_appendices/glossary.html)

(Is this hashi\_vault plugin?)

Cheers,

&nbsp;&nbsp;-vlado

---

<div class="post-metadata">

**Author:** ![Quentin\_Aveno](https://avatars.discourse-cdn.com/v4/letter/q/e9c0ed/32.png) [@Quentin\_Aveno](https://forum.ansible.com/u/Quentin_Aveno)\
**Post date:** [November 20, 2019, 1:54pm UTC](https://forum.ansible.com/t/lookup-vault-in-memory/31691/4 "2019-11-20T13:54:21Z")

</div>

Yes It is.  
I mean if I don’t use it as a variable but directly in a task as a parameter.  
As example:  
Is there a difference between

- shell: check.sh {{ lookup(‘hashi\_vault’, ‘secret=secret1’) }}  
And
- shell: check.sh {{ password 1}}  
Where password1 is defined in an inventory

It seems logical to me than the first one is safer and evaluate later

---

<div class="post-metadata">

**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\
**Post date:** [November 20, 2019, 3:22pm UTC](https://forum.ansible.com/t/lookup-vault-in-memory/31691/5 "2019-11-20T15:22:49Z")

</div>

I can only assume that "password1 is defined in an inventory" means a  
similar line can be found in an inventory

&nbsp;&nbsp;password1: "{{ lookup('hashi\_vault', 'secret=secret1') }}"

(Otherwise the comparison does not make much sense).

I can only repeat that both arguments below will be decrypted at the same  
time because of the "Lazy Evaluation" ("Ansible evaluates any variables in  
playbook content at the last possible second.")

&nbsp;&nbsp;- shell: "check.sh {{ lookup('hashi\_vault', 'secret=secret1') }}"  
&nbsp;&nbsp;- shell: "check.sh {{ password1 }}"

Cheers,

&nbsp;&nbsp;-vlado

---

<div class="post-metadata">

**Author:** ![Quentin\_Aveno](https://avatars.discourse-cdn.com/v4/letter/q/e9c0ed/32.png) [@Quentin\_Aveno](https://forum.ansible.com/u/Quentin_Aveno)\
**Post date:** [November 20, 2019, 3:45pm UTC](https://forum.ansible.com/t/lookup-vault-in-memory/31691/6 "2019-11-20T15:45:29Z")

</div>

Thanks vlado for your responses.

Yes, sorry for not being clear, password1 was defined in an inventory.

It's almost clear now.  
Does it mean that if i use a variable from inventory twice It will be evaluate twice or the variable will be store in memory ? Same question for lookup directly in task.

By the way, have you any advice in order to not store vault secret in memory.

And sorry for bad english (plus I write from a phone)

Have a nice day and thanks once again)

---

<div class="post-metadata">

**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\
**Post date:** [November 20, 2019, 6:00pm UTC](https://forum.ansible.com/t/lookup-vault-in-memory/31691/7 "2019-11-20T18:00:42Z")

</div>

> Does it mean that if i use a variable from inventory twice It will be  
> evaluate twice or the variable will be store in memory ? Same question for  
> lookup directly in task.

It will be evaluated twice. In general the expansions "{{ }}" will be "lazy"  
evaluated when referenced.

> By the way, have you any advice in order to not store vault secret in memory.

As described, the value is not stored in memory for longer time than needed, I  
think.

You're welcome. Cheers,

&nbsp;&nbsp;-vlado

---

<div class="post-metadata">

**Author:** ![Quentin\_Aveno](https://avatars.discourse-cdn.com/v4/letter/q/e9c0ed/32.png) [@Quentin\_Aveno](https://forum.ansible.com/u/Quentin_Aveno)\
**Post date:** [November 21, 2019, 12:00pm UTC](https://forum.ansible.com/t/lookup-vault-in-memory/31691/8 "2019-11-21T12:00:35Z")

</div>

Ok, thank you very much for your explanation.  
Have a nice day !