# Why not environment variable to store vault secrets ?

**URL:** <https://forum.ansible.com/t/why-not-environment-variable-to-store-vault-secrets/31602>\
**Category:** Ansible Developer\
**Created:** [November 5, 2019, 8:14pm UTC](https://forum.ansible.com/t/why-not-environment-variable-to-store-vault-secrets/31602 "2019-11-05T20:14:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gabriel\_Lewertowski](https://avatars.discourse-cdn.com/v4/letter/g/aeb1de/32.png) [@Gabriel\_Lewertowski](https://forum.ansible.com/u/Gabriel_Lewertowski)\
**Post date:** [November 5, 2019, 8:14pm UTC](https://forum.ansible.com/t/why-not-environment-variable-to-store-vault-secrets/31602/1 "2019-11-05T20:14:22Z")

</div>

Hi !

I wrote the PR [64383](https://github.com/ansible/ansible/pull/64383) to add an option for using environment to store vault secrets. The PR was rejected, I would like to know more about why storing secrets in environment is discouraged.

If the variable is exported, it’s of course not completely safe, as it allows processes to read the password in _/proc/$PID/environ_… but it can be prevented with AppArmor/Selinux. Anyway, storing secrets in cleartext files as it is currently recommended is not safe either.  
My idea was that with this feature, it would be possible to do :

read VAULT\_PASSWORD  
VAULT\_PASSWORD=$VAULT\_PASSWORD ansible-playbook … --vault-password-env “VAULT\_PASSWORD”

Nothing stays in the environment, nor in shell history, nor in cleartext file…

Maybe the developpers fear that some users could do things like :  
export VAULT\_PASSWORD=“MYPASSWORD”  
ansible-playbook …

which is of course a bad idea because the password is written in shell history…

bcoca who reviewed the PR says it’s achievable by using a vault script which reads the environment, this is true… but obviously more “hackish” : you and all those using the playbook must store the script, all must always use the same name for the the variable. and you have to store the variable in the environment, which is less safe than the behavior with “read VAULT\_PASSWORD; VAULT\_PASSWORD=$VAULT\_PASSWORD ansible-playbook …”

Thanks !  
GL

---

<div class="post-metadata">

**Author:** ![sdoran](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@sdoran](https://forum.ansible.com/u/sdoran)\
**Post date:** [November 12, 2019, 3:43pm UTC](https://forum.ansible.com/t/why-not-environment-variable-to-store-vault-secrets/31602/2 "2019-11-12T15:43:29Z")

</div>

Gabriel,

> Maybe the developpers fear that some users could do things like :  
> export VAULT\_PASSWORD="MYPASSWORD"  
> ansible-playbook ...
> 
> which is of course a bad idea because the password is written in shell history...

That's pretty much it: we don't want to encourage folks to store passwords in environment variables.

---

<div class="post-metadata">

**Author:** ![Fess\_Mage](https://avatars.discourse-cdn.com/v4/letter/f/9f8e36/32.png) [@Fess\_Mage](https://forum.ansible.com/u/Fess_Mage)\
**Post date:** [January 22, 2020, 12:16pm UTC](https://forum.ansible.com/t/why-not-environment-variable-to-store-vault-secrets/31602/3 "2020-01-22T12:16:57Z")

</div>

> That’s pretty much it: we don’t want to encourage folks to store passwords in environment variables.

The question is - why? Obviously env var is more secure than plain text file, which is current default for ansible. Of course its not the best available option, but still - better than now.