11 What is Ansible Vault and How does it work? | Mastering Ansible

And when it comes to security, how can we not speak about protecting sensitive information? That's where we welcome Ansible vault. Let's talk more about it. Hey everyone, before we dive into today's Anible session, I have something exciting to share. I am launching a complete mastering anible for beginners course very soon. And there's a link in the description to join my waiting list. And uh you will get early access, exclusive discounts, and be notified the moment it goes live. And if you don't know what a vault is, a vault is a secure storage or container used to protect valuable information or important or sensitive items from unauthorized access or damage. Welcome to the magic of anible vault. So in this section, we'll understand how anible vault transforms plain text into a cipher ensuring our sensitive data like database credentials remain under a secure environment. So let's see how it works. But before that I want to discuss something about anible vaults. So Anible vault uses AES or advanced encryption standard. So with a 256 bit key size which is a robust encryption algorithm used worldwide. So when we encrypt our data with anible vault, it converts our plain text credentials into cipher text. So this cipher text is uh immune to unauthorized access without the correct encryption key or passphrase. So by now we understand that if you have passwords or secret configuration and credentials, we can use vault or anible vault to store them and make them secure. But I'm sure you want to know more about it. So let's start with the same transport company example and let's see how we can make that application secure. Let's visualize this with the role of the transport coordinator. So here this rule requiresuling databases to be secure but accessible. The coordinator's database credential which is a plain text when encrypted using Ansible's vault transforms into a cipher text. This means that even if someone gains access to the Ansible playbook without the secret key or passways, the credentials remain a secret or a mystery. For anyone unauthorized, the data is just an undecipherable undecipherable code. But for you with the correct key, it is as accessible as if it were in plain text. And this is the essence of Ansible Vault. It's like having a secured lock and key for your most sensitive data while maintaining the ease of use. So let's do a recap once again. So here this rule requiresuling databases to be secure. The coordinator's database credential which is a plain text when encrypted using anible vault transforms into cipher text. which is encrypted. This means that even if someone gains access to the Ansible playbook, without the secret key or passphrase, the credentials remain a secret. And for anyone unauthorized, the data is just an undecipherable code. But for you with the correct key, it is accessible as if it were in plain text. And this is the essence of Ansible Vault. And when it comes to security or securing sensitive information, firstly it's essential to identify what needs protection. You must know like what actually what actually needs protection within our ansible environment. This means pinpointing valuable information that if compromised could pose risks. Once you've identified what needs protection, these valuables are encrypted using anible vault's AES 256 mechanism which turns sensitive information into secure cipher text. It is simple but confusing isn't it? But I think it's still manageable. So now let's understand the whole process using the same example but step by step. And this will show you how it is cyclic in nature. So as I said before it is essential to identify what needs protection. What are our valuable information that needs protection. So once we have identified that or once we have identified what needs protection these valuables are encrypted using anible vault's AS 256 mechanism which turns sensitive information into secure cipher texts and using AS 256 uh data is converted into encrypted format locking away the secret from unauthorized access and then to access the vault a vault password is required which will act as the key. So you know a vault has a lock and a lock needs a key to be opened and then it comes to the storage. So once the data is encrypted these valuables or sensitive data are stored inside the anible vault ensuring they remain secure. The next step is access and retrieve. The first is to provide password. The first is provide password vault. So when we encrypt sensitive data with vault you need to provide a anible vault password without it the contents remain secure and inaccessible. So if you don't have the password you cannot decrypt it and read what it's inside. So with the correct password the vault opens and the previously encrypted values are decrypted ready for use in the playbook as data in use. Next is monitor and audit. So we all need to understand that encryption is not a one-time thing. The important part about security and encryption is regularly resecuring valuables, changing the vault password if necessary, and conducting periodic security checks. That is why monitoring and auditing keeps your environment secure. Securing sensitive data is good, but it won't solve the problem if you don't maintain it. That is why cyclic and periodic monitoring and audit is important. And we can do that by re-encrypting sensitive data and changing the vault password if needed. And that is why the whole thing is a cycle of security. It starts by identifying valuables, determining what needs protection. Then we move to the anible vault where we encrypt the data that we have using as 256 mechanism and we store it using a vault password in the anible vault. with the world password that we have we actually retrieve the valuables and use them in the playbook that is access and retrieve and then we do a regular monitor and audit for the security and then if we want to we can actually resecure them so first we have two main points to remember about anible vault and I want you to remember them very carefully as you will be using it and I don't want you to come back and say that you didn't know this first thing is vault is specifically designed to keep sensitive data and encrypted files rather than plain text which is critical for security best practices. Second and most important point is encrypted files created by anible vault can be committed to version control system. Yes, you can commit those encrypted files to git or SVN or some version control tool that you use making it easier to manage infrastructure code without compromising security. That's amazing point isn't it? So let's check how you would create an encrypted file. So if you have a file let's say databaseconig.yamel which contains sensitive information that we need to secure. So for this we use the anible vault encrypt command. And here's how we would do it. The command that we would have is anible vault space encrypt. Then the file name which is databaseconfig.yamel in this case. Upon running the command, we will be prompted to enter a new vault password and then again to confirm it. So once the password is set, the file is encrypted and we'll receive a confirmation message that the encryption was successful. That's it. You run the command, enter the password which is a string which should obviously be a good compliant password. So once you confirm your file will be encrypted using the vault. So after successful encryption we need to decrypt the file that was encrypted as well. So here it is. So to access the content of the encrypted file we need to decrypt it with the anible vault decrypt command. So most importantly as common sense suggest we must use the same vault password that was used to encrypt the file. So which will prompt us to enter the vault password. Upon entering the correct password, the file will be decrypted and we'll receive the message confirming the decryption was successful. This has to be the most simplest thing, I guess, but this is just a start, so don't get too comfortable.