# Some doubts / problems about ansible-playbook with ansible-vault crypted files **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu\ **Created:** [November 21, 2014, 1:52pm UTC](https://forum.ansible.com/t/some-doubts-problems-about-ansible-playbook-with-ansible-vault-crypted-files/16841 "2014-11-21T13:52:03Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Ricard\_Clau](https://avatars.discourse-cdn.com/v4/letter/r/f19dbf/32.png) [@Ricard\_Clau](https://forum.ansible.com/u/Ricard_Clau)\ **Post date:** [November 21, 2014, 1:52pm UTC](https://forum.ansible.com/t/some-doubts-problems-about-ansible-playbook-with-ansible-vault-crypted-files/16841/1 "2014-11-21T13:52:03Z")
Hi everyone I was having a problem earlier today in a playbook using vault crypted files. I managed to refactor it to make it work but anyway I wanted to know your feedback in case this is my misunderstanding on how these features work or maybe there is some bug So, I was trying to create a playbook that connects to all ec2 instances and adds some public keys to the ubuntu generic user. I started with a playbook looking like this: tasks: - name: Add authorized keys for super users authorized\_key: user=ubuntu key=“{{ item }}” with\_file: - public\_keys/user1 - public\_keys/user2 Then I ran ansible-vault encrypt public\_keys/\* and when I re-run ansible-playbook providing the vault password the files were not being decrypted at runtime, so a key starting $ANSIBLE\_VAULT; was trying to get added to the boxes and obviously the task was giving an error “msg: invalid key specified:” I started refactoring the task using something like: a file called defaults/public\_keys.yml with this content: user1: publickey\_foruser1\_inlongstring user2: publickey\_foruser2\_inlongstring and refactored my playbook with: tasks: - include\_vars: defaults/public\_keys.yml - name: Add authorized keys for super users authorized\_key: user=ubuntu key=“{{ item }}” with\_items: - “{{ user1 }}” - “{{ user2 }}” Then I run ansible-vault encrypt to the new public\_keys.yml file and now it works flawlessly I assume this is related to the way vault decrypt is executed at runtime and not sure if this would be the expected behaviour or maybe the authorized\_key task needs some internal refactor to allocate this case where the supplied files may be crypted. I would really appreciate any comments on this, even if I managed to work around it Best ---
**Author:** ![David\_F](https://avatars.discourse-cdn.com/v4/letter/d/d2c977/32.png) [@David\_F](https://forum.ansible.com/u/David_F)\ **Post date:** [November 21, 2014, 6:50pm UTC](https://forum.ansible.com/t/some-doubts-problems-about-ansible-playbook-with-ansible-vault-crypted-files/16841/2 "2014-11-21T18:50:39Z")
Why are we encrypting public keys? ---
**Author:** ![James\_Martin1](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@James\_Martin1](https://forum.ansible.com/u/James_Martin1)\ **Post date:** [November 21, 2014, 6:51pm UTC](https://forum.ansible.com/t/some-doubts-problems-about-ansible-playbook-with-ansible-vault-crypted-files/16841/3 "2014-11-21T18:51:03Z")
ansible-vault only works for structured data files (yaml, json). Also, out of curiosity, why bother encrypting public keys? - James ---
**Author:** ![Ricard\_Clau](https://avatars.discourse-cdn.com/v4/letter/r/f19dbf/32.png) [@Ricard\_Clau](https://forum.ansible.com/u/Ricard_Clau)\ **Post date:** [November 24, 2014, 8:03pm UTC](https://forum.ansible.com/t/some-doubts-problems-about-ansible-playbook-with-ansible-vault-crypted-files/16841/4 "2014-11-24T20:03:32Z")
Well, maybe I am doing something terribly stupid… these files will be stored in bitbucket / github as part of the ansible infrastructure repo so if someone got access to them they could use them to get access to our EC2 instances, right? Definitely not as terrible as a database password but still concerning security-wise unless I am missing something And anyway, it was just an experiment, if vault only works for structured data files this is the explanation I was looking for, Cheers James ---
**Author:** ![James\_Martin1](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@James\_Martin1](https://forum.ansible.com/u/James_Martin1)\ **Post date:** [November 24, 2014, 8:17pm UTC](https://forum.ansible.com/t/some-doubts-problems-about-ansible-playbook-with-ansible-vault-crypted-files/16841/5 "2014-11-24T20:17:04Z")
Ricard, You’re mixing up public keys and private keys. - James ---
**Author:** ![Ricard\_Clau](https://avatars.discourse-cdn.com/v4/letter/r/f19dbf/32.png) [@Ricard\_Clau](https://forum.ansible.com/u/Ricard_Clau)\ **Post date:** [November 25, 2014, 11:13am UTC](https://forum.ansible.com/t/some-doubts-problems-about-ansible-playbook-with-ansible-vault-crypted-files/16841/6 "2014-11-25T11:13:18Z")
You are totally right, even if they stole the public keys, without the private key nothing can be done so I was effectively doing something quite stupid 🙂 Best