Encrypt a File with ansible-vault create
Protect a secrets file end to end.
Encrypt a File with ansible-vault create is a free Ansible Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ansible Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Secrets in Plain YAML?
Playbooks live in Git, so a database password sitting in plain vars is a leak waiting to happen. You need encryption at rest. 🔒
Meet Ansible Vault
Ansible Vault encrypts files and variables so secrets can be committed safely. Ansible decrypts them only at run time.
Create an Encrypted File
The ansible-vault create command makes a brand-new file that is encrypted from the very first keystroke.
ansible-vault create secrets.ymlSet a Vault Password
On create, Vault prompts you for a password twice. This single passphrase is what locks and later unlocks the file.
New Vault password:
Confirm New Vault password:Edit in Your Editor
After the password, Vault opens your $EDITOR with a plaintext buffer. Type secrets as normal YAML here.
db_password: s3cr3t
api_key: AKIA123EXAMPLESaved Encrypted
When you save and quit, Vault encrypts the whole buffer. The file on disk is now ciphertext, never the plaintext you typed.
What the File Looks Like
An encrypted file starts with the $ANSIBLE_VAULT header followed by the version, cipher and hex blob. That header is how Ansible knows to decrypt it.
$ANSIBLE_VAULT;1.1;AES256
66386439653...
3935613...AES256 Under the Hood
Vault uses AES256 symmetric encryption. Strength rests entirely on your password, so pick a long, unique one.
Encrypt an Existing File
Already have a plaintext file? Use ansible-vault encrypt to lock it in place instead of starting fresh.
ansible-vault encrypt vars/prod.ymlSafe to Commit
Because the contents are ciphertext, you can commit secrets.yml to Git. Anyone without the password sees only gibberish.
git add secrets.yml
git commit -m "Add vaulted secrets"Organize Vault Files
A common pattern keeps secrets in a vault.yml under group_vars, sitting beside a plain vars.yml that points to them.
group_vars/
all/
vars.yml
vault.ymlQuick Check
You want a new secrets file that is encrypted from the start.
Recap
You used ansible-vault create to make an AES256-encrypted secrets file. It carries a $ANSIBLE_VAULT header and is safe to commit. ✨
Frequently asked questions
Is the “Encrypt a File with ansible-vault create” lesson free?
Yes — the full text of “Encrypt a File with ansible-vault create” is free to read here on the web, and the Ansible Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ansible Academy course, upgrade to CoddyKit PRO.
What will I learn in “Encrypt a File with ansible-vault create”?
Protect a secrets file end to end. You practise Ansible Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Ansible Academy?
No prior experience is required. Ansible Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Encrypt a File with ansible-vault create” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Ansible Academy lesson?
Yes. Every Ansible Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Encrypt a File with ansible-vault create
- Edit, View & Rekey Vault Files
- Encrypt a Single Variable Inline
- Decrypt at Runtime with --ask-vault-pass