Decrypt at Runtime with --ask-vault-pass
Supply the password to a play.
Decrypt at Runtime with --ask-vault-pass is a free DevOps Bootcamp lesson on CoddyKit. This is lesson 4 of 4. Any 3 lessons of this learning path are free to read in full — after that, CoddyKit PRO unlocks every lesson, plus hands-on practice with a built-in code editor and a 24/7 AI tutor. It is part of the DevOps Bootcamp learning path, and your progress syncs across the web and the CoddyKit app. The DevOps Bootcamp course includes 4 lessons in total.
Decrypt at the Right Moment
Vaulted secrets stay encrypted on disk. The trick is feeding Ansible the password exactly when a play needs to read them. 🔑
Prompt for the Password
Add --ask-vault-pass to ansible-playbook and Ansible asks for the vault password once before the run begins.
ansible-playbook site.yml --ask-vault-passOne Password, Whole Run
That single prompt unlocks every vaulted file and inline value the play touches. Ansible decrypts them in memory only. 🧠
Missing Password Fails Fast
Run a play that needs Vault without supplying a password and Ansible stops with a clear decryption error before doing harm.
ERROR! Attempting to decrypt but no vault secrets foundUse a Password File
For unattended runs, point at a --vault-password-file instead of typing. Keep that file out of Git and locked down.
ansible-playbook site.yml --vault-password-file ~/.vault_passSet It in ansible.cfg
To avoid the flag every time, declare the password file under vault_password_file in your ansible.cfg.
[defaults]
vault_password_file = ~/.vault_passOr Use an Environment Variable
The ANSIBLE_VAULT_PASSWORD_FILE env var does the same job, handy in CI where you cannot edit config.
export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_passVault IDs for Many Secrets
Manage multiple passwords with --vault-id, labeling each so dev and prod secrets use different keys.
ansible-playbook site.yml --vault-id prod@~/.vault_prodOther Commands Too
The same flags work with ansible ad-hoc commands and ansible-vault itself, not just ansible-playbook.
ansible all -m debug -a "msg={{ db_password }}" --ask-vault-passKeep the Password Safe
Vault is only as strong as where you store its password. Use a secrets manager or restricted file, never commit it.
Script the Password Source
A vault password file can even be an executable script that prints the password, letting it fetch secrets from a vault server.
ansible-playbook site.yml --vault-password-file get-pass.shQuick Check
You run a playbook that reads vaulted vars and want to type the password once.
Recap
You unlock secrets at run time with --ask-vault-pass, a password file or an env var. Ansible decrypts in memory only. ✨
Learn DevOps Bootcamp with an AI tutor — free
Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.
- Courses
- 142
- Lessons
- 568
Frequently Asked Questions
Is the “Decrypt at Runtime with --ask-vault-pass” lesson free?
Yes — any 3 lessons of the DevOps Bootcamp learning path, including “Decrypt at Runtime with --ask-vault-pass”, are free to read in full here on the web. After that, CoddyKit PRO unlocks every lesson, plus interactive practice with a built-in code editor and a 24/7 AI tutor. The DevOps Bootcamp course includes 4 lessons in total.
What will I learn in “Decrypt at Runtime with --ask-vault-pass”?
Supply the password to a play. You practise DevOps Bootcamp with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start DevOps Bootcamp?
No prior experience is required. DevOps Bootcamp on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 4 of 4.
How long does the “Decrypt at Runtime with --ask-vault-pass” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this DevOps Bootcamp lesson?
Yes. Every DevOps Bootcamp lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Encrypt a File with ansible-vault create
- Edit, View & Rekey Vault Files
- Encrypt a Single Variable Inline
- Decrypt at Runtime with --ask-vault-pass