Decrypt at Runtime with --ask-vault-pass
Supply the password to a play.
Decrypt at Runtime with --ask-vault-pass is a free Ansible Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ansible Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Decrypt at the Right Moment
Vaulted secrets stay encrypted on disk. The trick is feeding Ansible the password exactly when a play needs to read them. 🔑
Prompt for the Password
Add --ask-vault-pass to ansible-playbook and Ansible asks for the vault password once before the run begins.
ansible-playbook site.yml --ask-vault-passOne Password, Whole Run
That single prompt unlocks every vaulted file and inline value the play touches. Ansible decrypts them in memory only. 🧠
Missing Password Fails Fast
Run a play that needs Vault without supplying a password and Ansible stops with a clear decryption error before doing harm.
ERROR! Attempting to decrypt but no vault secrets foundUse a Password File
For unattended runs, point at a --vault-password-file instead of typing. Keep that file out of Git and locked down.
ansible-playbook site.yml --vault-password-file ~/.vault_passSet It in ansible.cfg
To avoid the flag every time, declare the password file under vault_password_file in your ansible.cfg.
[defaults]
vault_password_file = ~/.vault_passOr Use an Environment Variable
The ANSIBLE_VAULT_PASSWORD_FILE env var does the same job, handy in CI where you cannot edit config.
export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_passVault IDs for Many Secrets
Manage multiple passwords with --vault-id, labeling each so dev and prod secrets use different keys.
ansible-playbook site.yml --vault-id prod@~/.vault_prodOther Commands Too
The same flags work with ansible ad-hoc commands and ansible-vault itself, not just ansible-playbook.
ansible all -m debug -a "msg={{ db_password }}" --ask-vault-passKeep the Password Safe
Vault is only as strong as where you store its password. Use a secrets manager or restricted file, never commit it.
Script the Password Source
A vault password file can even be an executable script that prints the password, letting it fetch secrets from a vault server.
ansible-playbook site.yml --vault-password-file get-pass.shQuick Check
You run a playbook that reads vaulted vars and want to type the password once.
Recap
You unlock secrets at run time with --ask-vault-pass, a password file or an env var. Ansible decrypts in memory only. ✨
Frequently asked questions
Is the “Decrypt at Runtime with --ask-vault-pass” lesson free?
Yes — the full text of “Decrypt at Runtime with --ask-vault-pass” is free to read here on the web, and the Ansible Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ansible Academy course, upgrade to CoddyKit PRO.
What will I learn in “Decrypt at Runtime with --ask-vault-pass”?
Supply the password to a play. You practise Ansible Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ansible Academy?
No prior experience is required. Ansible Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Decrypt at Runtime with --ask-vault-pass” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ansible Academy lesson?
Yes. Every Ansible Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Encrypt a File with ansible-vault create
- Edit, View & Rekey Vault Files
- Encrypt a Single Variable Inline
- Decrypt at Runtime with --ask-vault-pass