The Ansible Vault Architecture

Ansible vault is designed for playbook developers, system administrators, and related personnel to store sensitive data within a playbook, variable file, or directory structure. The encryption system employed by Ansible vault is based on the Symmetrical Key Advanced Encryption System or AES Symmetrical Key solution. The AES Symmetrical Key encryption provides us with an easy-to-use way of using the same key to encrypt data as well as decrypt data. The following diagram provides an illustration of AES Symmetrical Key Encryption:

The Ansible vault solution has been designed to provide encryption services for any structured data file supported by Ansible. This means we can encrypt group_vars/, AND host_vars/.. inventory variable directories. It also means we can encrypt variable files loaded within the include_vars/vars_files. As we can see from the preceding, the supported supported by Ansible's vault solution is vast. Basically in the end it means we can encrypt...