# Vaulted credentials with AWS Dynamic Inventory?

**URL:** <https://forum.ansible.com/t/vaulted-credentials-with-aws-dynamic-inventory/9250>\
**Category:** Get Help\
**Tags:** ansible-vault, aws\
**Created:** [September 28, 2024, 4:42pm UTC](https://forum.ansible.com/t/vaulted-credentials-with-aws-dynamic-inventory/9250 "2024-09-28T16:42:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Artem\_Vakhitov](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/artem_vakhitov/32/4864_2.png) [@Artem\_Vakhitov](https://forum.ansible.com/u/Artem_Vakhitov)\
**Post date:** [September 28, 2024, 4:42pm UTC](https://forum.ansible.com/t/vaulted-credentials-with-aws-dynamic-inventory/9250/1 "2024-09-28T16:42:00Z")

</div>

Is it possible to pass AWS credentials from Ansible Vault directly to the AWS Dynamic Inventory config file (\*.aws\_ec2.yml), without having to reference them in the playbook or decrypt on the go and export as environment variables?

---

<div class="post-metadata">

**Author:** ![tremble](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tremble/32/247_2.png) [@tremble](https://forum.ansible.com/u/tremble)\
**Post date:** [September 30, 2024, 8:33am UTC](https://forum.ansible.com/t/vaulted-credentials-with-aws-dynamic-inventory/9250/2 "2024-09-30T08:33:29Z")

</div>

Yes, you can use templating for the credential parameters.

There’s a (sort of) example in the [integration tests](https://github.com/ansible-collections/amazon.aws/blob/main/tests/integration/targets/inventory_aws_ec2/templates/inventory_with_template.yml.j2).

This looks a little strange in the test because, due to the way the tests are run, the test that file is also a template (yeah this gets a little inception-esque). It eventually looks something like:

```auto
plugin: amazon.aws.aws_ec2
access_key: '{{ lookup("env", "MY_ACCESS_KEY") }}'
secret_key: my_aws_secret_key
session_token: my_security_token

regions:
- '{{ lookup("ansible.builtin.ini", "region", section="ansible-test", file="config.ini") }}'
filters:
  tag:Name:
  - my_resource_prefix
hostnames:
- tag:Name
- dns-name

```

While this example uses the “ansible.builtin.ini” and “env” lookups, you can also use a vault lookup.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [October 30, 2024, 8:33am UTC](https://forum.ansible.com/t/vaulted-credentials-with-aws-dynamic-inventory/9250/3 "2024-10-30T08:33:39Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.