🚨 Ansible Error: 'Attempting to decrypt but no vault secrets found' — Cause, Fix, and Troubleshooting Guide

Overview

Ansible encounters vault-encrypted content (a $ANSIBLE_VAULT file or an !vault inline value) but you have not given it any vault secret to decrypt with. Unlike a wrong-password failure, this means Ansible has no password at all:

ERROR! Attempting to decrypt but no vault secrets found

It fires as soon as Ansible tries to read the encrypted data during play load or task execution.

Symptoms

• The run stops the moment it touches an encrypted var file or !vault value.
• Adding --ask-vault-pass prompts and then works.
• A teammate’s run works because their ANSIBLE_VAULT_PASSWORD_FILE is set.

ansible-playbook -i inventory.ini site.yml

ERROR! Attempting to decrypt but no vault secrets found

Common Root Causes

1. No vault password supplied

You ran the playbook without --ask-vault-pass, --vault-password-file, or a configured default.

2. vault_password_file not configured or wrong path

ansible.cfg points at a file that does not exist, or the env var is unset in this shell/CI job.

3. Missing --vault-id label

Content encrypted under a labeled vault id (--vault-id prod@...) needs that label; a bare password may not match.

4. Encrypted file committed but secret never provisioned in CI

The repo has vaulted vars, but the pipeline never injects the password.

How to diagnose

Confirm the content is actually vaulted:

head -1 group_vars/all/vault.yml

$ANSIBLE_VAULT;1.1;AES256

Check what vault config Ansible sees:

ansible-config dump | grep -i vault
echo "ANSIBLE_VAULT_PASSWORD_FILE=$ANSIBLE_VAULT_PASSWORD_FILE"

Fixes

Prompt for the password (quick)

ansible-playbook -i inventory.ini site.yml --ask-vault-pass

Use a vault password file (automation)

ansible-playbook -i inventory.ini site.yml --vault-password-file ~/.vault_pass

Or set it once in ansible.cfg:

# ansible.cfg
[defaults]
vault_password_file = ~/.vault_pass

Use a labeled vault id when required

ansible-playbook -i inventory.ini site.yml --vault-id prod@~/.vault_pass_prod

Provide the secret in CI

# CI: write the secret to a file from a masked variable, then reference it
printf '%s' "$VAULT_PASSWORD" > .vault_pass
ansible-playbook -i inventory.ini site.yml --vault-password-file .vault_pass

What to watch out for

• This error means no secret was found; a wrong secret produces a decryption/HMAC error instead — different fix.
• A vault_password_file can be an executable script that prints the password (useful for pulling from a secrets manager).
• Never commit the vault password file itself; add it to .gitignore and inject it at runtime.

Related

• Ansible Error: ‘Vault decryption failed’
• Managing Ansible Vault Secrets Without Losing Your Mind
• Rotating Ansible Vault Keys at Scale With AI Assistance