0

I want to store the ansible vault password in aws secret manager and then use the CLI to decrypt the contents in the vault by referencing to the password stored in aws secret manager when required....How can I do that?

I have stored the password as a secret in aws secret manager, but I don't know how to give a reference to the secret using CLI.

I thought using Ansible-vault view --vault-password-file="path" would work. But I dont know how to give access to that path and also make the password secure.

ITSA
  • 1
  • 1

1 Answers1

2

If the file pointed to by the vault_password_file option is executable, then Ansible will run that file to retrieve the password. That means you can put this in your ansible.cfg:

[defaults]
vault_password_file = ./get-vault-password.sh

And this in get-vault-password.sh:

#!/bin/sh

exec aws secretsmanager get-secret-value \
  --secret-id your-vault-secret \
  --query SecretString \
  --output text

Make the file executable (chmod +x get-vault-password.sh), and as long as you have appropriate AWS credentials loaded in your environment, Ansible will use that script to retrieve the vault password.

larsks
  • 277,717
  • 41
  • 399
  • 399