# When are vault values resolved during playbook?

**URL:** <https://forum.ansible.com/t/when-are-vault-values-resolved-during-playbook/15292>\
**Category:** Ansible Project\
**Created:** [May 21, 2014, 1:54pm UTC](https://forum.ansible.com/t/when-are-vault-values-resolved-during-playbook/15292 "2014-05-21T13:54:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Derptacos](https://avatars.discourse-cdn.com/v4/letter/d/b5a626/32.png) [@Derptacos](https://forum.ansible.com/u/Derptacos)\
**Post date:** [May 21, 2014, 1:54pm UTC](https://forum.ansible.com/t/when-are-vault-values-resolved-during-playbook/15292/1 "2014-05-21T13:54:01Z")

</div>

I have a playbook that requires a value from a vault - but I am consistently running into issues regarding the existence of this variable (lets call this variable private\_key)

In the vault I have:

foo:  
private\_key: |  
“…”

In the playbook I have:

- { role: bar, bar: {  
‘private\_key’: ‘{{foo.private\_key}}’,  
}  
}

The error itself: One or more undefined variables: ‘dict object’ has no attribute ‘private\_key’

When are the values within the vault resolved when running a playbook? Or am I approaching the use of vault values the incorrect way?

Thank you!

---

<div class="post-metadata">

**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\
**Post date:** [May 21, 2014, 2:10pm UTC](https://forum.ansible.com/t/when-are-vault-values-resolved-during-playbook/15292/2 "2014-05-21T14:10:03Z")

</div>

Where in the playbook are you specifying the vault file? Is it in vars\_files or somewhere else?

---

<div class="post-metadata">

**Author:** ![Derptacos](https://avatars.discourse-cdn.com/v4/letter/d/b5a626/32.png) [@Derptacos](https://forum.ansible.com/u/Derptacos)\
**Post date:** [May 21, 2014, 2:16pm UTC](https://forum.ansible.com/t/when-are-vault-values-resolved-during-playbook/15292/3 "2014-05-21T14:16:52Z")

</div>

The file is in group\_vars

---

<div class="post-metadata">

**Author:** ![Derptacos](https://avatars.discourse-cdn.com/v4/letter/d/b5a626/32.png) [@Derptacos](https://forum.ansible.com/u/Derptacos)\
**Post date:** [May 21, 2014, 2:42pm UTC](https://forum.ansible.com/t/when-are-vault-values-resolved-during-playbook/15292/4 "2014-05-21T14:42:18Z")

</div>

I explicitly loaded the file in the playbook and it seems to have resolved the issue.

vars\_files:

- group\_vars/secret.yml

---

<div class="post-metadata">

**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\
**Post date:** [May 21, 2014, 2:44pm UTC](https://forum.ansible.com/t/when-are-vault-values-resolved-during-playbook/15292/5 "2014-05-21T14:44:07Z")

</div>

Inventory variables are resolved after roles are read in, so yes moving the vault file to the vars\_files section is the correct placement.

---

<div class="post-metadata">

**Author:** ![Serge\_van\_Ginderacht](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@Serge\_van\_Ginderacht](https://forum.ansible.com/u/Serge_van_Ginderacht)\
**Post date:** [May 21, 2014, 2:49pm UTC](https://forum.ansible.com/t/when-are-vault-values-resolved-during-playbook/15292/6 "2014-05-21T14:49:30Z")

</div>

​But having a non-inventory ​variable file within group\_vars is not a good  
idea to me ( see also the other thread I just replied on).

I you happen to have a group 'secret' , thise will also get the secrets,  
which might not be what you intended.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [May 21, 2014, 10:15pm UTC](https://forum.ansible.com/t/when-are-vault-values-resolved-during-playbook/15292/7 "2014-05-21T22:15:14Z")

</div>

Agree with Serge above on “group\_vars” being a confusing name for this.

But yes, the fact that a file needs a vault password will be detected at the point that file is read.