The Secret Storage Problem
Every real-world automation involves secrets: database passwords, API keys, TLS private keys, cloud provider credentials. These values must be accessible to Ansible at runtime, but they must never appear in plain text in your Git repository.
Ansible Vault is Ansible's built-in encryption tool. It uses AES-256 encryption to protect sensitive files or individual variable values, and integrates transparently into the normal playbook execution flow.
Encrypting a Variables File
A file can be created already encrypted, or an existing plain-text file can be encrypted in place; encrypted files can also be viewed or edited without ever writing decrypted content to disk, and decrypted back to plain text when no longer needed.
The convention is to keep encrypted values in a separate file with variable names prefixed vault_, and a companion plain-text file (safe to commit) that simply references each vault_ variable under its real name — so the repository's actual task and playbook code never has to know or care which values came from the encrypted source.
Running Playbooks with Vault
A playbook run needs the vault password to decrypt those files at execution time — supplied either as an interactive prompt, or read from a password file (the standard pattern for CI/CD), or scoped per environment via multiple named vault IDs. In CI/CD pipelines, the vault password is typically stored as a pipeline secret (e.g., a GitHub Actions secret or GitLab CI variable) and written to a temporary file at the start of the pipeline run.
Interviewers ask: "How do you handle secrets in Ansible without exposing them in Git?" The complete answer covers three layers: "Ansible Vault encrypts the secret values themselves using AES-256, so the encrypted file is safe to commit. At runtime, the vault password is provided via --vault-password-file pointing to a file that is never committed — in CI/CD, this file is written from a pipeline secret variable. For the highest security, Vault (HashiCorp) or AWS Secrets Manager can be used as the secret backend, with Ansible fetching secrets at runtime using lookup plugins rather than storing them in the repository at all."