vault variable is not decrypted when using ansible_vault

[Sam2 (Sam)]

Hello Everyone,

In my case I am trying to pass my password to a command, thus I am using vault encrypt_string, I followed the steps as in:

Support vault encrypted secrets in the inventory source

1- I have vault credential with same Vault ID I used to encrypt my password

2- the variable is defined in template extra variables:

However the secret is not decrypted, I tried to print the var and it is printing the encrypted value:

20
“secret_var_name”: {

21
“__ansible_vault”: “$ANSIBLE_VAULT;1.2;AES256;samer\n38376137646163323539306639336232623239306661346364663439393838666231346433306364\n6361333538373761376435343335613830623837623664610a643938616264346436633137376263\n31616434363032326465633830316366383136343062383661383435636630346233353262643535\n3537383466393766300a616166346634393336336436636133356565363034653737373936363834\n3733”

22
}

[AlanCoding (Alan Rominger)]

You cannot use this feature with job template extra_vars. This is because we do a behind-the-scenes YAML conversion without the needed mock-object utilities in the decoders / encoders. I have a proposed fix at:

https://github.com/ansible/awx/pull/2297

(attachments)

[Sam2 (Sam)]

Thanks Alan,

I went through the link but honestly I couldn’t understand the proposed solution, should I use JSON code for vault var or should I use: https://gist.github.com/sivel/6991a5abcfc41bb2872d5898213575eb script ? and not usre really how to use.

Thanks
Samer

(attachments)

[AlanCoding (Alan Rominger)]

There is no way to use this feature (pasting that syntax into job template extra_vars) without that fix. There is also no way to use the YAML marker for vault content. In other words, right now, there is no way for you to use encrypted vault content in job template extra_vars.

(attachments)

[Sam2 (Sam)]

Got it thanks a lot

(attachments)

[Sam2 (Sam)]

Hello Alan,

I was thinking about the vault topic again and I went through you illustration to use vault encrypted vars, this mean that AWX admin can decrypt any encrypted vault var by assigning the to the right vault credentials in a job template, I believe AWX template has permission to credentials and can easily use any of them so he can use them to decrypt secret vars/files. right ?

Thanks
Samer

(attachments)

[AlanCoding (Alan Rominger)]

The superuser with access to the server can ultimately decrypt everything you save one way or the other.

AWX template has permission to credentials

You need use role for the credential to use it in a template. Then, the credential, combined with the variables, can decrypt them and use or echo the plantext value within the ansible-playbook runtime context.

If you want to protect your secrets from all other users, use credential prompt on launch. When you launch, you type in your password, and then the server will forget the provided password after the work is finished. Of course, there could still be artifacts in the job data, depending on how you write your playbooks.

(attachments)