# Two vault files with the same password - will it work?

**URL:** <https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517>\
**Category:** Get Help\
**Tags:** ansible-vault\
**Created:** [May 7, 2025, 2:21pm UTC](https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517 "2025-05-07T14:21:02Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![King](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@King](https://forum.ansible.com/u/King)\
**Post date:** [May 7, 2025, 2:21pm UTC](https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517/1 "2025-05-07T14:21:02Z")

</div>

Hi!  
I would like to use one vault password with two files with encrypted variables. The main variable I need is ansible\_password that is used to connect to hosts, and it is different for different users.

I tried the vault ID feature with no luck. I have vault\_user1.yml and vault\_user2.yml. They were encrypted with the same password and two vault IDs:

- user1
- user2

When I run the first playbook with this command:

```auto
ansible-playbook playbook1.yml -i inventory.yml --user user1 --vault-id user1@/path/to/vault-client.sh

```

I get the decrypted value of ansible\_password from vault\_user1.yml.

Then I run the second playbook like this:

```auto
ansible-playbook playbook2.yml -i inventory.yml --user user2 --vault-id user2@/path/to/vault-client.sh

```

and get the decrypted value of ansible\_password from vault\_user1.yml again. Am I missing something? It looks like the vault-id is not validated.

Is there any simple way to have one variable with two values encrypted with the same password?

---

<div class="post-metadata">

**Author:** ![schuert](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/schuert/32/7494_2.png) [@schuert](https://forum.ansible.com/u/schuert)\
**Post date:** [May 7, 2025, 3:09pm UTC](https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517/2 "2025-05-07T15:09:32Z")

</div>

If you supply a password and all vaults are encrypted with that password all can be decrypted, no need for a vault id. In your case, when a variable is defined twice the last value assigned is used. Try something like this

- name: read user password  
Ansible.builtin.include\_vars: “{{ username }}.yml”

Then create multiple var files in vars:

vars/username1.yml  
vars/username2.yml

So that the password is only read once for the user currently needed.

---

<div class="post-metadata">

**Author:** ![King](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@King](https://forum.ansible.com/u/King)\
**Post date:** [May 7, 2025, 3:26pm UTC](https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517/3 "2025-05-07T15:26:48Z")

</div>

Thanks for the quick reply. I found one mistake in my solution. The variable files were in group\_vars directory, so they were loaded by default.  
I prepared new files in the vars directory but still didn’t get what I needed. I will need more time to check it.

---

<div class="post-metadata">

**Author:** ![schuert](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/schuert/32/7494_2.png) [@schuert](https://forum.ansible.com/u/schuert)\
**Post date:** [May 7, 2025, 4:27pm UTC](https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517/4 "2025-05-07T16:27:43Z")

</div>

If you post the parts of your playbook that reads the variables, I could give you some more tipps. Group and / or host\_vars will only work if the group / host defines the user that should be configured. Otherwise I would use a task like the one I have posted

---

<div class="post-metadata">

**Author:** ![brazzledazzleday](https://avatars.discourse-cdn.com/v4/letter/b/898d66/32.png) [@brazzledazzleday](https://forum.ansible.com/u/brazzledazzleday)\
**Post date:** [May 7, 2025, 6:47pm UTC](https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517/5 "2025-05-07T18:47:03Z")

</div>

You’re encrypting `vault_user1.yml` and `vault_user2.yml` with the **same password** , but Ansible Vault IDs are only useful when you’re encrypting files with **different passwords**. Vault ID tagging doesn’t select which file to use — it just maps a name (`user1`, `user2`) to a specific password source. If both vault files use the same password, you can decrypt both without distinguishing IDs.

* * *

### Proper Methodology to Fix the Use Case

#### GOAL:

Use one vault password file, two vault-encrypted variable files (`vault_user1.yml` and `vault_user2.yml`), and decrypt the correct one depending on which user is running.

#### SOLUTION:

Instead of using `--vault-id`, which is mainly for managing **multiple passwords** , just use `--ask-vault-pass` (for prompt) or `--vault-password-file` and load **only** the correct variable file per playbook:

##### Folder structure:

```auto
vault_user1.yml
vault_user2.yml
group_vars/
  all.yml

```

##### `vault_user1.yml` example:

```yaml
ansible_password: !vault |
  $ANSIBLE_VAULT;1.1;AES256
  ...

```

##### `playbook1.yml`:

```yaml
- hosts: user1
  vars_files:
    - vault_user1.yml
  tasks:
    - debug: var=ansible_password

```

##### Run command:

```bash
ansible-playbook playbook1.yml --vault-password-file ~/.vault_pass.txt

```

Do the same for `user2`, with `vault_user2.yml`.

---

<div class="post-metadata">

**Author:** ![King](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@King](https://forum.ansible.com/u/King)\
**Post date:** [May 8, 2025, 11:32am UTC](https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517/6 "2025-05-08T11:32:12Z")

</div>

I have /install/vars/vault\_user1.yml and /install/vars/vault\_user2.yml, and added this in /install/playbook1.yml as the first task:

```auto
- name: Read user password
  hosts: all
  tasks:
    - name: Read user passwords
      ansible.builtin.include_vars:
        file: vault_user1.yml

    - name: Check ansible_password
      ansible.builtin.debug:
        msg:
        - "The password is: {{ ansible_password }}"
        - "The become password is: {{ ansible_become_password }}"

```

But it failed with this error:  
“Data could not be sent to remote host "192.168.1.5". Make sure this host can be reached over ssh: [user1@192.168.1.5](mailto:user1@192.168.1.5): Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).”

So it looks like it tries to log in using SSH keys and not the password from the variable file although I provide the vault password.

---

<div class="post-metadata">

**Author:** ![schuert](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/schuert/32/7494_2.png) [@schuert](https://forum.ansible.com/u/schuert)\
**Post date:** [May 8, 2025, 1:34pm UTC](https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517/7 "2025-05-08T13:34:41Z")

</div>

Use -vvv when running the playbook. I bet ansible is using the correct password but with the wrong user (root instead of user1). This can be set if I’m not mistaken with

ansible\_user: user1  
ansible\_password: “{{ user\_password }}”

---

<div class="post-metadata">

**Author:** ![schuert](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/schuert/32/7494_2.png) [@schuert](https://forum.ansible.com/u/schuert)\
**Post date:** [May 8, 2025, 1:36pm UTC](https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517/8 "2025-05-08T13:36:08Z")

</div>

Try: delegate\_to: localhost

so that the debug task shows something even if the host can’t be reached via ssh

---

<div class="post-metadata">

**Author:** ![King](https://avatars.discourse-cdn.com/v4/letter/k/a9adbd/32.png) [@King](https://forum.ansible.com/u/King)\
**Post date:** [May 8, 2025, 2:56pm UTC](https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517/9 "2025-05-08T14:56:31Z")

</div>

Thank you for suggestions again! It was my mistake. When I added

```auto
gather_facts: false

```

to the “Read user password” play, it started working.

It looks like it tried to gather facts before the variable file was included, so there was no value for ansible\_password.

PS ping me when you’re in Gdansk PL; I’ll be happy to buy you guys a coffee or a beer and have a chat.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [June 7, 2025, 2:57pm UTC](https://forum.ansible.com/t/two-vault-files-with-the-same-password-will-it-work/42517/10 "2025-06-07T14:57:28Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.