How to automate ansible vault decryption?

Question

I want to automate the decryption of ansible vault and not to have to specify the vault location or password from the command line.

Mainly, I am looking for a solution what would work in a way that similar to how ~/.netrc works. When you put credentials there the tools (like curl, wget,...) will know to load them.

If you don't it the execution will have.

That's quite important because I need to be able to automate the execution of these ansible playbooks, so prompt for password is clearly not an option.

Also, I do not want to have to add --vault-password-file parameter to each playbook. Any ideas?

Answer 1

Much like the inventory, if vault-password-file has the executable bit set, Ansible will run it and use stdout as the password.

That allows you to write a script that wraps the password in PGP encryption, sits in a limited-access S3 bucket, uses AWS KMS, or whatever strikes your fancy.