ansible-vault | ansible lookup plugin for secrets | Identity Management library

Well i dont know what the issue was but changing :

Following my comments: you cannot view an encrypted var inside a playbook with the technique proposed in the documentation, for memory:

In your logs, we can see the following error:

There are a lot of possibilities gives by shell expansions.

Here are two that would be interesting in your case:

• The asterisk * expansion, that is used as a wildcard. Which means that host_vars/*/vault would match both host_vars/host1/vault and host_vars/host2/vault but any other in the future, too.
• Mind that, if, in the future, you have a more complex folder hierarchy host_vars/*/vault will only match one folder level (e.g. it won't match host_vars/level1/host1/vault), but multiple folder levels can be achieved with a double asterisk (actually named globstar): host_vars/**/vault, will match host_vars/host1/vault as well as host_vars/level1/host1/vault
• The brace expansion, on the other hands offer a more granular set of possibilities, for examples, if I have hosts names after the distributions like RedHat[1..5], Ubuntu[1..5] and Debian[1..5], I could target only the Debian and RedHat ones via host_vars/{Ubuntu*,RedHat*}/vault.
  Or only target the three first of them both with host_vars/{Ubuntu{1..3},RedHat{1..3}}/vault, or the three first of them all via host_vars/*{1..3}/vault

As a more practical example, if you where to handle SE via Ansible and would like to encrypt the the files for *.stackexchange.com and stackoverflow.com but not superuser.com or any other Q&A having a specific domain name, given that the hosts are named as their DNS name, you could do

You wouldn't put any sensitive information in your template, just the variable name, the same way you would have with copy + content.

why dont use template for your config file:

use a template file.j2 like this for example:

While it would make much more sense to assign a List value for the tags parameter like you did, the documentation does show the value should be a String. What the documentation does not explain is what the delimiter is for multiple tags. If we check the Github repository README example snippet for the plugin, we see that the tags parameter String value should be comma delimited for multiple Ansible tags. For your specific use case, this parameter would appear like:

You want to do either

There are no modules I know to use ansible-vault from playbooks directly (besides the obvious intended use which is to decrypt variables and file contents on the fly).

One possible way to improve security (as far as listing processes is concerned) with your ansible-vault example through a command would be to use the interactive prompt mode and fill the password with the expect module. An other security layer can be added by adding the no_log: true parameter to the task so it does not print content of the variables.

Here is a simple example (you will need to pip install pexpect on the target host):