ansible-vault:tldr:1d55b

The command ansible-vault encrypt_string is used to encrypt sensitive data (such as passwords, API keys, or other secret variables) in Ansible playbooks or variable files.

When you run ansible-vault encrypt_string, you provide the string that you want to encrypt as an argument. The command then encrypts that string and outputs it in an encrypted format.

This encrypted string can then be stored in your playbook or variable file, and whenever Ansible needs to use it, it will automatically decrypt it using a password you specify. This way, you can keep your sensitive data secure within your Ansible configuration.

For example, suppose you have a password "mySecretPassword" that you don't want to store in plain text within your playbook. You can run the following command:

ansible-vault encrypt_string --vault-password-file=vault_pass.txt 'mySecretPassword'

This command will encrypt the password and generate output like:

!vault |
          $ANSIBLE_VAULT;1.1;AES256
          61373333303663323231373539303564646166303363383461623363626135366632663864623361
          6536393164393730373439326230626635393461623336380a353639303361393966343862616265
          39656261313732656562313635633663616231346432643761386466303631316564373738633435
          3763333563376632340a623238326239653661666565326166663730323064303431356230313135
          38343263353562373265633031396564626532363039333331653964373636396132363964
Encryption successful

You can then copy this encrypted string and use it in your playbook like this:

- name: Example playbook
  hosts: localhost
  vars:
    my_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          61373333303663323231373539303564646166303363383461623363626135366632663864623361
          6536393164393730373439326230626635393461623336380a353639303361393966343862616265
          39656261313732656562313635633663616231346432643761386466303631316564373738633435
          3763333563376632340a623238326239653661666565326166663730323064303431356230313135
          38343263353562373265633031396564626532363039333331653964373636396132363964
  tasks:
    - name: Print password
      debug:
        var: my_password

Ansible will automatically decrypt the encrypted string using the password you provide when running the playbook, and you can use the decrypted value within your tasks.