# Securely Storing Personal Credentials for Ansible Without Compromising Convenience

**URL:** <https://forum.ansible.com/t/securely-storing-personal-credentials-for-ansible-without-compromising-convenience/2604>\
**Category:** Get Help\
**Tags:** ansible-vault, ansible-lint\
**Created:** [November 27, 2023, 11:29pm UTC](https://forum.ansible.com/t/securely-storing-personal-credentials-for-ansible-without-compromising-convenience/2604 "2023-11-27T23:29:24Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![jbericat](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jbericat/32/627_2.png) [@jbericat](https://forum.ansible.com/u/jbericat)\
**Post date:** [December 11, 2023, 1:01am UTC](https://forum.ansible.com/t/securely-storing-personal-credentials-for-ansible-without-compromising-convenience/2604/6 "2023-12-11T01:01:35Z")

</div>

Hello @gawainsr,

Let’s recap our discussion a bit:

You’ve expressed a preference for maintaining a balance between security and ease of use, aiming to manage personal credentials within a shared environment **without making extensive infrastructure changes** , as mentioned in your earlier post:

> [@gawainsr](#):
>
> I’m seeking advice or alternative solutions that balance security with ease of use. How can I effectively manage personal credentials in this shared environment without extensive infrastructure changes?

Given this, it seems you’re inclined to proceed with the `ansible-vault` method, despite considering alternative options previously suggested to you, is that correct?

On the other hand, **you’ve also set specific constraints** regarding the use of `ansible-vault`:

> [@gawainsr](#):
>
> I’m trying to avoid storing the encrypted content AND decryption key/passphrase within my profile, so my criteria would be.
> 
> - Decryption key cannot be stored locally on the host.
> - Decryption key cannot be visible in command shell history.

Considering these constraints, the safest and most user-friendly way I can think of is to temporarily store your vault password in volatile memory (environment variable), so it doesn’t stick around after logging-out of your session or a reboot. You could set this up to kick in when you log in and wipe it from memory when you log out, maybe using something like a .profile setup and so on (I remember using a similar approach with ansible-navigator, which should also work similarly for ansible-playbook CLI command). Here’s a link to the `ansible-navigator` docs that might help (notice that it gives details on how to set-up the vault password on an environment variable while preventing storing it on the shell history):

[https://ansible.readthedocs.io/projects/navigator/faq/#how-can-i-use-a-vault-password-with-ansible-navigator](https://ansible.readthedocs.io/projects/navigator/faq/#how-can-i-use-a-vault-password-with-ansible-navigator)

Honestly, I can’t think of a better way to meet your needs just using `ansible-vault` right now. If anyone else has different ideas or improvements, I’m all ears! 😊

---

_[View the full topic](https://forum.ansible.com/t/securely-storing-personal-credentials-for-ansible-without-compromising-convenience/2604)._