# vault variable is not decrypted when using ansible\_vault **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [November 20, 2018, 12:31pm UTC](https://forum.ansible.com/t/vault-variable-is-not-decrypted-when-using-ansible-vault/29076 "2018-11-20T12:31:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sam2](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@Sam2](https://forum.ansible.com/u/Sam2)\ **Post date:** [November 20, 2018, 12:31pm UTC](https://forum.ansible.com/t/vault-variable-is-not-decrypted-when-using-ansible-vault/29076/1 "2018-11-20T12:31:47Z")
Hello Everyone, In my case I am trying to pass my password to a command, thus I am using vault encrypt\_string, I followed the steps as in: > > > \##### ISSUE TYPE > - Bug Report > > \##### COMPONENT NAME > > - API > > \##### SUMMA…RY > > AWX inventory source can't handle Vault encrypted secrets for the simple ini-like inventory ("Sourced from the project" in the UI). > > For example, I have an ini-like inventory and a few variables in the \`group\_vars\` that are encrypted with Ansible Vault (like in \[this example repo\](https://github.com/dzeban/example-ansible-vault-inventory)). When I add this inventory source and try to sync it I get the following error: > > \`\`\` > 2017-09-20 11:45:09,104 INFO awx.main.commands.inventory\_import Updating inventory 2: Production > 2017-09-20 11:45:09,114 DEBUG awx.main.commands.inventory\_import Using backported ansible-inventory module: /usr/lib/python2.7/site-packages/awx/plugins/ansible\_inventory/backport.py > 2017-09-20 11:45:09,114 INFO awx.main.commands.inventory\_import Reading Ansible inventory source: /var/lib/awx/projects/\_6\_\_myproj/inventory > 2017-09-20 11:45:09,114 INFO awx.main.commands.inventory\_import Command: \['/usr/lib/python2.7/site-packages/awx/plugins/ansible\_inventory/backport.py', '-i', '/var/lib/awx/projects/\_6\_\_myproj/inventory'\] > Traceback (most recent call last): > File "/usr/bin/awx-manage", line 9, in \ > load\_entry\_point('awx==1.0.0.487', 'console\_scripts', 'awx-manage')() > File "/usr/lib/python2.7/site-packages/awx/\_\_init\_\_.py", line 107, in manage > execute\_from\_command\_line(sys.argv) > File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/management/\_\_init\_\_.py", line 354, in execute\_from\_command\_line > utility.execute() > File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/management/\_\_init\_\_.py", line 346, in execute > self.fetch\_command(subcommand).run\_from\_argv(self.argv) > File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/management/base.py", line 394, in run\_from\_argv > self.execute(\*args, \*\*cmd\_options) > File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/management/base.py", line 445, in execute > output = self.handle(\*args, \*\*options) > File "/var/lib/awx/venv/awx/lib/python2.7/site-packages/django/core/management/base.py", line 661, in handle > return self.handle\_noargs(\*\*options) > File "/usr/lib/python2.7/site-packages/awx/main/management/commands/inventory\_import.py", line 956, in handle\_noargs > self.is\_custom) > File "/usr/lib/python2.7/site-packages/awx/main/management/commands/inventory\_import.py", line 211, in load\_inventory\_source > is\_custom=is\_custom).load() > File "/usr/lib/python2.7/site-packages/awx/main/management/commands/inventory\_import.py", line 180, in load > data = self.command\_to\_json(base\_args + \['--list'\]) > File "/usr/lib/python2.7/site-packages/awx/main/management/commands/inventory\_import.py", line 163, in command\_to\_json > self.method, proc.returncode, stdout, stderr)) > RuntimeError: ansible-inventory backport failed (rc=1) with stdout: > > stderr: > ERROR! Decryption failed on /var/lib/awx/projects/\_6\_\_myproj/inventory/group\_vars/aws/credentials.yml > \`\`\` > > You can't set Vault credential for the inventory source - trying to add it via UI shows "NO CREDENTIALS HAVE BEEN CREATED" window. Even if you set the Vault credential by typing its name in the input field it's still not used - I get the same error. > > \##### ENVIRONMENT > > \* AWX version: 1.0.0.487 > \* Ansible version: 2.3.2.0 > \* Operating System: Debian 8 > \* Web Browser: Google Chrome 61 > > \##### ADDITIONAL INFORMATION > > I'll gladly help with fixing this if somebody would give me some hints. I've tried to hack the patch by myself but I can't figure out how to pass vault credential from \`RunInventoryUpdate\` task to the \`inventory\_import.py\` management command. 1- I have vault credential with same Vault ID I used to encrypt my password 2- the variable is defined in template extra variables: ![awx1.png](https://us1.discourse-cdn.com/ansible/original/2X/c/c3515d22293daf12f07d686c6784ca469827548c.png) However the secret is not decrypted, I tried to print the var and it is printing the encrypted value: 20 “secret\_var\_name”: { 21 “\_\_ansible\_vault”: “$ANSIBLE\_VAULT;1.2;AES256;samer\n38376137646163323539306639336232623239306661346364663439393838666231346433306364\n6361333538373761376435343335613830623837623664610a643938616264346436633137376263\n31616434363032326465633830316366383136343062383661383435636630346233353262643535\n3537383466393766300a616166346634393336336436636133356565363034653737373936363834\n3733” 22 } ---
**Author:** ![AlanCoding](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/alancoding/32/301_2.png) [@AlanCoding](https://forum.ansible.com/u/AlanCoding)\ **Post date:** [November 20, 2018, 1:38pm UTC](https://forum.ansible.com/t/vault-variable-is-not-decrypted-when-using-ansible-vault/29076/2 "2018-11-20T13:38:50Z")
You cannot use this feature with job template extra\_vars. This is because we do a behind-the-scenes YAML conversion without the needed mock-object utilities in the decoders / encoders. I have a proposed fix at: [https://github.com/ansible/awx/pull/2297](https://github.com/ansible/awx/pull/2297) > **(attachments)** > > ![awx1.png](https://us1.discourse-cdn.com/ansible/original/2X/c/c3515d22293daf12f07d686c6784ca469827548c.png) ---
**Author:** ![Sam2](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@Sam2](https://forum.ansible.com/u/Sam2)\ **Post date:** [November 20, 2018, 2:04pm UTC](https://forum.ansible.com/t/vault-variable-is-not-decrypted-when-using-ansible-vault/29076/3 "2018-11-20T14:04:44Z")
Thanks Alan, I went through the link but honestly I couldn’t understand the proposed solution, should I use JSON code for vault var or should I use: [https://gist.github.com/sivel/6991a5abcfc41bb2872d5898213575eb](https://gist.github.com/sivel/6991a5abcfc41bb2872d5898213575eb) script ? and not usre really how to use. Thanks Samer > **(attachments)** > > ![awx1.png](https://us1.discourse-cdn.com/ansible/original/2X/c/c3515d22293daf12f07d686c6784ca469827548c.png) ---
**Author:** ![AlanCoding](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/alancoding/32/301_2.png) [@AlanCoding](https://forum.ansible.com/u/AlanCoding)\ **Post date:** [November 20, 2018, 2:07pm UTC](https://forum.ansible.com/t/vault-variable-is-not-decrypted-when-using-ansible-vault/29076/4 "2018-11-20T14:07:45Z")
There is no way to use this feature (pasting that syntax into job template extra\_vars) without that fix. There is also no way to use the YAML marker for vault content. In other words, right now, there is no way for you to use encrypted vault content in job template extra\_vars. > **(attachments)** > > ![awx1.png](https://us1.discourse-cdn.com/ansible/original/2X/c/c3515d22293daf12f07d686c6784ca469827548c.png) ---
**Author:** ![Sam2](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@Sam2](https://forum.ansible.com/u/Sam2)\ **Post date:** [November 20, 2018, 2:15pm UTC](https://forum.ansible.com/t/vault-variable-is-not-decrypted-when-using-ansible-vault/29076/5 "2018-11-20T14:15:17Z")
Got it thanks a lot > **(attachments)** > > ![awx1.png](https://us1.discourse-cdn.com/ansible/original/2X/c/c3515d22293daf12f07d686c6784ca469827548c.png) ---
**Author:** ![Sam2](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@Sam2](https://forum.ansible.com/u/Sam2)\ **Post date:** [November 21, 2018, 2:42pm UTC](https://forum.ansible.com/t/vault-variable-is-not-decrypted-when-using-ansible-vault/29076/6 "2018-11-21T14:42:49Z")
Hello Alan, I was thinking about the vault topic again and I went through you illustration to use vault encrypted vars, this mean that AWX admin can decrypt any encrypted vault var by assigning the to the right vault credentials in a job template, I believe AWX template has permission to credentials and can easily use any of them so he can use them to decrypt secret vars/files. right ? Thanks Samer > **(attachments)** > > ![awx1.png](https://us1.discourse-cdn.com/ansible/original/2X/c/c3515d22293daf12f07d686c6784ca469827548c.png) ---
**Author:** ![AlanCoding](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/alancoding/32/301_2.png) [@AlanCoding](https://forum.ansible.com/u/AlanCoding)\ **Post date:** [November 21, 2018, 5:51pm UTC](https://forum.ansible.com/t/vault-variable-is-not-decrypted-when-using-ansible-vault/29076/7 "2018-11-21T17:51:37Z")
The superuser with access to the server can ultimately decrypt everything you save one way or the other. > AWX template has permission to credentials You need use role for the credential to use it in a template. Then, the credential, combined with the variables, can decrypt them and use or echo the plantext value within the ansible-playbook runtime context. If you want to protect your secrets from all other users, use credential prompt on launch. When you launch, you type in your password, and then the server will forget the provided password after the work is finished. Of course, there could still be artifacts in the job data, depending on how you write your playbooks. > **(attachments)** > > ![awx1.png](https://us1.discourse-cdn.com/ansible/original/2X/c/c3515d22293daf12f07d686c6784ca469827548c.png)