# Set VAULT\_TOKEN environment variable in AWX

**URL:** <https://forum.ansible.com/t/set-vault-token-environment-variable-in-awx/32254>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [February 17, 2020, 5:31pm UTC](https://forum.ansible.com/t/set-vault-token-environment-variable-in-awx/32254 "2020-02-17T17:31:05Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jan\_Stenvall](https://avatars.discourse-cdn.com/v4/letter/j/258eb7/32.png) [@Jan\_Stenvall](https://forum.ansible.com/u/Jan_Stenvall)\
**Post date:** [February 17, 2020, 5:31pm UTC](https://forum.ansible.com/t/set-vault-token-environment-variable-in-awx/32254/1 "2020-02-17T17:31:05Z")

</div>

Hello,

In my playbook I’m using the hashi\_vault lookup. According to the specification of the plugin, one way to authenticate against vault is to use the VAULT\_TOKEN environment variable (see [https://docs.ansible.com/ansible/latest/plugins/lookup/hashi\_vault.html](https://docs.ansible.com/ansible/latest/plugins/lookup/hashi_vault.html))

As there are no way to modify the environment variables during an ansible play, I wonder how I can set this variable in AWX for a job. You can use a functionality called Survey, but it prompts for this before each run.

Ideally, the VAULT\_TOKEN is stored in a file with privileged access only, or stored as a credential in AWX.

How can this be acheived?

Thanks for any input on this subject.

//Jan

---

<div class="post-metadata">

**Author:** ![Karolis\_Pocius](https://avatars.discourse-cdn.com/v4/letter/k/d26b3c/32.png) [@Karolis\_Pocius](https://forum.ansible.com/u/Karolis_Pocius)\
**Post date:** [February 17, 2020, 8:02pm UTC](https://forum.ansible.com/t/set-vault-token-environment-variable-in-awx/32254/2 "2020-02-17T20:02:19Z")

</div>

I haven’t tried this myself, but I’d imagine using HashiCorp Vault Secret Lookup credential type and attaching it to the template would expose the token to the job.

[https://docs.ansible.com/ansible-tower/latest/html/userguide/credential\_plugins.html#hashicorp-vault-secret-lookup](https://docs.ansible.com/ansible-tower/latest/html/userguide/credential_plugins.html#hashicorp-vault-secret-lookup)

---

<div class="post-metadata">

**Author:** ![Ryan\_Cummins](https://avatars.discourse-cdn.com/v4/letter/r/eada6e/32.png) [@Ryan\_Cummins](https://forum.ansible.com/u/Ryan_Cummins)\
**Post date:** [February 17, 2020, 9:55pm UTC](https://forum.ansible.com/t/set-vault-token-environment-variable-in-awx/32254/3 "2020-02-17T21:55:16Z")

</div>

This will likely require a custom credential type to inject the VAULT\_ADDR and VAULT\_TOKEN values as environment vars during a job template run. The approach is described in this blog post: [https://www.ansible.com/blog/ansible-tower-feature-spotlight-custom-credentials](https://www.ansible.com/blog/ansible-tower-feature-spotlight-custom-credentials)

The newer, built-in HashiCorp Vault Secret Lookup credential type works by being “linked” to another credential type as an input source for specific fields, as described here: [https://docs.ansible.com/ansible-tower/3.6.2/html/userguide/credential\_plugins.html#configure-and-link-secret-lookups](https://docs.ansible.com/ansible-tower/3.6.2/html/userguide/credential_plugins.html#configure-and-link-secret-lookups)

---

<div class="post-metadata">

**Author:** ![Jan\_Stenvall](https://avatars.discourse-cdn.com/v4/letter/j/258eb7/32.png) [@Jan\_Stenvall](https://forum.ansible.com/u/Jan_Stenvall)\
**Post date:** [February 19, 2020, 8:11am UTC](https://forum.ansible.com/t/set-vault-token-environment-variable-in-awx/32254/4 "2020-02-19T08:11:53Z")

</div>

@Ryan

Perfect, the blog post explains how to perform just that. It works like charm. Thanks a lot !

//Jan

---

<div class="post-metadata">

**Author:** ![Joao\_Santos](https://avatars.discourse-cdn.com/v4/letter/j/db5fbb/32.png) [@Joao\_Santos](https://forum.ansible.com/u/Joao_Santos)\
**Post date:** [February 20, 2020, 11:10am UTC](https://forum.ansible.com/t/set-vault-token-environment-variable-in-awx/32254/5 "2020-02-20T11:10:28Z")

</div>

Hi, did you added the credential to the job itself?  
Edit the job and on the credentials field add the same.

---

<div class="post-metadata">

**Author:** ![Jan\_Stenvall](https://avatars.discourse-cdn.com/v4/letter/j/258eb7/32.png) [@Jan\_Stenvall](https://forum.ansible.com/u/Jan_Stenvall)\
**Post date:** [February 20, 2020, 12:22pm UTC](https://forum.ansible.com/t/set-vault-token-environment-variable-in-awx/32254/6 "2020-02-20T12:22:26Z")

</div>

Thanks, I missed that obvious part of the equation. Thanks it works as intended.

//Jan