# specify --vault-password-file in ansible.cfg file **URL:** \ **Category:** Ansible Project\ **Tags:** aws\ **Created:** [September 16, 2014, 9:41am UTC](https://forum.ansible.com/t/specify-vault-password-file-in-ansible-cfg-file/16239 "2014-09-16T09:41:41Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Jason\_Harris](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@Jason\_Harris](https://forum.ansible.com/u/Jason_Harris)\ **Post date:** [September 16, 2014, 9:41am UTC](https://forum.ansible.com/t/specify-vault-password-file-in-ansible-cfg-file/16239/1 "2014-09-16T09:41:41Z")
Hi All, It would be handy to be able to specify a default vault-password-file in the ansible configuration file. That way when we are operating within the ansible role we can easily encrypt, edit, and decrypt files without having to always add: –vault-password-file ~/.vault\_pass.txt We can of course create a bash alias for this but it doesn’t vary when we are in different ansible projects… Also, it would be nice to have a ansible-vault cat | more | less etc to easily look at the file contents. And in fact it might be nice to be able to have several passwords in vault\_pass, which are tried in succession. Ie we might have vault\_pass.txt be: general\_pass : aYLNOrPGA9qEYDxs aws\_deploy\_keys: BbqxyxGBqjSC3kVt super\_secrete\_key: KeqZqnXvCHQJ7hDx That way we could handle out say the general\_pass to some people working on general things, and say give out the aws deploy keys to a smaller set of people, and finally only a few people would know the super\_secret\_keys. Thanks, Jason ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 16, 2014, 12:31pm UTC](https://forum.ansible.com/t/specify-vault-password-file-in-ansible-cfg-file/16239/2 "2014-09-16T12:31:08Z")
It seems that as this file is frequently world readable, and probably should be for completeness of knowing what settings are, that putting a password in this file is not a good idea. Also, there’s an ansible-vault view to easily see file contents that does open a pager these days. That might only be on the devel-branch as I don’t really remember. ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [September 16, 2014, 12:35pm UTC](https://forum.ansible.com/t/specify-vault-password-file-in-ansible-cfg-file/16239/3 "2014-09-16T12:35:40Z")
There is indeed a way to specify this in the ansible.cfg file: [defaults] vault\_password\_file = /path/to/password\_file Additionally of note, is that the --vault-password-file can also be a script, and if marked as executable the script will be executed and can respond with the password. Then you can store your password in something like keychain on Mac and have the script retrieve it. (I’ve submitted a PR to show how to do this at [https://github.com/ansible/ansible/pull/8561](https://github.com/ansible/ansible/pull/8561)) ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 16, 2014, 3:12pm UTC](https://forum.ansible.com/t/specify-vault-password-file-in-ansible-cfg-file/16239/4 "2014-09-16T15:12:08Z")
Sorry, reading too fast, I thought I read “password” not file. I should mention this is an undocumented option, which we always strive to correct. This should be listed here: [http://docs.ansible.com/intro\_configuration.html](http://docs.ansible.com/intro_configuration.html) and also in examples/ansible.cfg Which gets shipped on RPM distros as the stock config file. Please file a bug or something, or a pull request – if you would like – and we’ll take care of it. ---
**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\ **Post date:** [September 16, 2014, 3:19pm UTC](https://forum.ansible.com/t/specify-vault-password-file-in-ansible-cfg-file/16239/5 "2014-09-16T15:19:14Z")
Since it is mostly my fault that it is not documented, I’ll submit a PR to rectify the omission. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 16, 2014, 3:21pm UTC](https://forum.ansible.com/t/specify-vault-password-file-in-ansible-cfg-file/16239/6 "2014-09-16T15:21:56Z")
Excellent, thank you! (Bonus points for adding force\_color at the same time… though that may be me trying to pull a Tom Sawyer type option about how fun it is to add option documentation!) ---
**Author:** ![Jason\_Harris](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@Jason\_Harris](https://forum.ansible.com/u/Jason_Harris)\ **Post date:** [September 16, 2014, 9:19pm UTC](https://forum.ansible.com/t/specify-vault-password-file-in-ansible-cfg-file/16239/7 "2014-09-16T21:19:34Z")
That is great! Thanks! The keyring solution is a really nice touch! ---
**Author:** ![Jason\_Harris](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@Jason\_Harris](https://forum.ansible.com/u/Jason_Harris)\ **Post date:** [September 16, 2014, 9:22pm UTC](https://forum.ansible.com/t/specify-vault-password-file-in-ansible-cfg-file/16239/8 "2014-09-16T21:22:49Z")
Ahh, nice to know this is coming. Thanks!