# Single Encrypted Value

**URL:** <https://forum.ansible.com/t/single-encrypted-value/26104>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [November 22, 2017, 8:27am UTC](https://forum.ansible.com/t/single-encrypted-value/26104 "2017-11-22T08:27:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![chris.he.kn](https://avatars.discourse-cdn.com/v4/letter/c/439d5e/32.png) [@chris.he.kn](https://forum.ansible.com/u/chris.he.kn)\
**Post date:** [November 22, 2017, 8:27am UTC](https://forum.ansible.com/t/single-encrypted-value/26104/1 "2017-11-22T08:27:20Z")

</div>

Hi

I am trying to add Single Encrypted Values to host variables in AWX - see [http://docs.ansible.com/ansible/latest/playbooks\_vault.html.](http://docs.ansible.com/ansible/latest/playbooks_vault.html.)

The UI errors with message

> data : [object Object] status : 400 headers : function (name){if(headersObj||(headersObj=parseHeaders(headers)),name){var value=headersObj[lowercase(name)];return void 0===value&&(value=null),value}return headersObj} config : [object Object] statusText : BAD REQUEST xhrStatus : complete

if I use the example from the above ansible docs.  
Anybody any idea how to get this working.

Regards

Chris

---

<div class="post-metadata">

**Author:** ![AlanCoding](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/alancoding/32/301_2.png) [@AlanCoding](https://forum.ansible.com/u/AlanCoding)\
**Post date:** [November 27, 2017, 4:45pm UTC](https://forum.ansible.com/t/single-encrypted-value/26104/2 "2017-11-27T16:45:54Z")

</div>

You can’t just paste in vaulted variables into the UI. We are working on allowing you to import vaulted variables within an inventory import, but that is still in-progress. This new feature would allow you to save vaulted variables inside of source control, and then import those variables into AWX. We are still unsure if we would have any obfuscation or encryption for those variables after they are imported. There are not any plans for a feature to allow manual copy and pasting of vault content into the UI for host/inventory/group variables.

---

<div class="post-metadata">

**Author:** ![Robin\_Miller](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@Robin\_Miller](https://forum.ansible.com/u/Robin_Miller)\
**Post date:** [November 29, 2017, 4:00pm UTC](https://forum.ansible.com/t/single-encrypted-value/26104/3 "2017-11-29T16:00:54Z")

</div>

Huh - I hadn’t played with it yet but had assumed we could do this and was planning to use it. So, to clarify, we can’t use individual encrypted variable values on Inventory resources, but we can in individual Job Template Extra-Vars?

-R

---

<div class="post-metadata">

**Author:** ![AlanCoding](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/alancoding/32/301_2.png) [@AlanCoding](https://forum.ansible.com/u/AlanCoding)\
**Post date:** [November 29, 2017, 7:39pm UTC](https://forum.ansible.com/t/single-encrypted-value/26104/4 "2017-11-29T19:39:42Z")

</div>

I have not actually tested giving a job template variable a vault-encrypted value in the UI, but I suspect it would work. This is because Ansible core does all the magic for detecting individual vault variables, and the vault credential you attach enables the job to respond to the prompt for the vault password.

Inventory imports have an extra layer of indirection. They are invoked by an awx-manage command, which is a custom Django management command. My first attempt at this feature involved using python’s Popen to pass through any password prompts to the management command into the subprocess running ansible-inventory. We will still do something like this, but because there are multiple prompts for vault credentials in Ansible 2.4 (organized by vault id), we will need to use the full power of pexpect. That means that we’ll run ansible-inventory inside of the pexpect, inside of a management command inside of pexpect.

In summary, yes, I agree with what you are saying.

---

<div class="post-metadata">

**Author:** ![Bill\_Nottingham1](https://avatars.discourse-cdn.com/v4/letter/b/58f4c7/32.png) [@Bill\_Nottingham1](https://forum.ansible.com/u/Bill_Nottingham1)\
**Post date:** [November 29, 2017, 7:55pm UTC](https://forum.ansible.com/t/single-encrypted-value/26104/5 "2017-11-29T19:55:43Z")

</div>

Alan Rominger (arominge@redhat.com) said:

> I have not actually tested giving a job template variable a vault-encrypted  
> value in the UI, but I suspect it would work. This is because Ansible core  
> does all the magic for detecting individual vault variables, and the vault  
> credential you attach enables the job to respond to the prompt for the  
> vault password.

IIRC, this doesn't work because something in the variable validation falls  
over before it is saved. Haven't tried in the past couple of months, though.

Bill