How do you protect secrets in Ansible?
⚡
Quick Answer
Encrypt sensitive files or variables with Ansible Vault; decrypt at run time with a vault password.
Detailed Answer
ansible-vault encrypt/create protects files (e.g. group_vars/prod/secrets.yml) with AES; they're decrypted in memory during the run. Provide the password via --ask-vault-pass interactively or --vault-password-file in CI backed by a secret store. Never commit plaintext credentials.
💡
Interview Tip
Mention --vault-password-file for non-interactive CI.
ansiblevaultsecrets