🚨 Ansible Error Guide: 'Decryption failed' — Fix Vault Secret Access

Overview

This error means Ansible found an !vault-encrypted value (or an ansible-vault encrypted file) but none of the vault secrets available to the run could decrypt it. The ciphertext is present and well-formed, but the password — or the matching vault ID — is missing or wrong. Nothing on the target host is even attempted; the play stops during variable loading.

The literal message looks like this:

ERROR! Attempting to decrypt but no vault secrets found

or, when a password was supplied but does not match the one used to encrypt:

ERROR! Decryption failed (no vault secrets were found that could decrypt) on /home/deploy/site/group_vars/prod/vault.yml

The key phrase is no vault secrets were found that could decrypt. It is an access/credential problem, not corruption in most cases — the fix is supplying the correct password or vault ID, not editing the ciphertext.

Symptoms

• The play aborts immediately with Decryption failed or no vault secrets found, before any task runs.
• A file encrypted by a teammate refuses to open with your password.
• Adding a new vault-encrypted var works locally but fails in CI, where no vault password is configured.
• The error names a specific file (group_vars/prod/vault.yml) or points at an inline !vault value.
• A multi-vault-ID setup fails only for one environment (e.g. prod) while dev decrypts fine.

ansible-playbook -i inventory.ini site.yml

ERROR! Decryption failed (no vault secrets were found that could decrypt) on /home/deploy/site/group_vars/prod/vault.yml

Common Root Causes

1. No vault password provided at all

The playbook references encrypted vars but the run was launched without --ask-vault-pass, --vault-password-file, or a configured vault_password_file.

ERROR! Attempting to decrypt but no vault secrets found

2. Wrong vault password

A password was supplied, but it is not the one the file was encrypted with (typo, wrong file, or the secret was rotated).

ERROR! Decryption failed (no vault secrets were found that could decrypt) on .../vault.yml

3. Vault ID mismatch

The file was encrypted with a labeled vault ID (--encrypt-vault-id prod) but the run only provides a different ID, or a default password that does not match that label.

ansible-vault view group_vars/prod/vault.yml

ERROR! Decryption failed (no vault secrets were found that could decrypt)

4. Password file resolves to the wrong content

A --vault-password-file points at a script whose output has a trailing newline, extra whitespace, or an error message instead of the password.

5. Corrupted or truncated ciphertext

A merge conflict, a partial copy, or an editor that reformatted the $ANSIBLE_VAULT;1.1;AES256 header leaves the payload undecryptable even with the right password.

ERROR! input is not vault encrypted data for group_vars/prod/vault.yml

Diagnostic Workflow

Step 1: Confirm the file really is a vault file

Inspect the header. A valid vault file starts with the $ANSIBLE_VAULT marker and a version/cipher/optional vault-id.

head -1 group_vars/prod/vault.yml

$ANSIBLE_VAULT;1.2;AES256;prod

The fourth field (prod) is the vault ID label — you must supply a secret for exactly that ID.

Step 2: Test decryption in isolation with ansible-vault view

Take the playbook out of the picture and prove the password against the file directly:

ansible-vault view group_vars/prod/vault.yml --vault-id prod@prompt

If this succeeds, the credential is correct and the problem is how the playbook run is passing the password. If it fails here, the password or vault ID is wrong.

Step 3: List what vault IDs the run actually provides

Check ansible.cfg and the command line for every source of a vault secret:

grep -n 'vault_password_file\|vault_identity_list' ansible.cfg

vault_identity_list = dev@~/.vault_dev, prod@~/.vault_prod

The file’s header ID must appear in this list (or be passed with --vault-id).

Step 4: Verify the password file’s exact output

If using a password file or script, print what it emits so hidden whitespace is visible:

~/.vault_prod | od -c | tail -3

A stray \n inside the password (as opposed to at the very end, which Ansible strips) or a shell error printed instead of the secret will cause the mismatch.

Step 5: Re-run with the explicit, labeled vault ID

Bypass ambiguous defaults and name the ID directly:

# playbook run, made explicit:
# ansible-playbook -i inventory.ini site.yml \
#   --vault-id dev@~/.vault_dev \
#   --vault-id prod@~/.vault_prod

ansible-playbook -i inventory.ini site.yml \
  --vault-id prod@prompt --limit prod

Example Root Cause Analysis

CI started failing on the prod environment only, with dev deploys still green:

ERROR! Decryption failed (no vault secrets were found that could decrypt) on group_vars/prod/vault.yml

Step 1 shows the file header carries a labeled ID:

head -1 group_vars/prod/vault.yml

$ANSIBLE_VAULT;1.2;AES256;prod

Step 3 reveals what CI actually provides:

grep -n 'vault_identity_list\|vault_password_file' ansible.cfg

vault_password_file = /run/secrets/vault_dev

The CI runner only mounts the dev vault password, with no label. The prod vault file was encrypted under the prod vault ID, whose secret is not present in the pipeline. Locally it worked because the engineer had prod@~/.vault_prod in their personal vault_identity_list.

Root cause: the prod vault secret was never provisioned to CI. Fix — mount the prod password and register it with the matching ID:

ansible-playbook -i inventory.ini site.yml \
  --vault-id dev@/run/secrets/vault_dev \
  --vault-id prod@/run/secrets/vault_prod

CI now decrypts both environments because every vault ID referenced by an encrypted file has a matching secret.

Prevention Best Practices

• Always label vaults with a vault ID (--vault-id prod@...) so a run fails loudly on the right environment instead of silently trying the wrong password.
• Keep vault_identity_list in ansible.cfg in sync between developer machines and CI so the same encrypted files decrypt everywhere.
• Store vault passwords in a secret manager and mount them at runtime; never commit a vault_password_file’s contents to the repo.
• When rotating a vault password, ansible-vault rekey every affected file in the same change and update all consumers (CI secrets, teammates) atomically.
• Add a lightweight preflight (ansible-vault view on a canary file) to CI so a missing secret fails fast with a clear message rather than mid-play.
• For a stuck decryption chain across many files, the free incident assistant can help map which vault IDs each file needs. See more in the Ansible guides.

Quick Command Reference

# Is it actually a vault file, and which vault ID?
head -1 group_vars/prod/vault.yml
# -> $ANSIBLE_VAULT;1.2;AES256;prod   (last field = vault ID)

# Test the password against the file directly
ansible-vault view group_vars/prod/vault.yml --vault-id prod@prompt

# What vault IDs does the run provide?
grep -n 'vault_password_file\|vault_identity_list' ansible.cfg

# Inspect a password file's exact bytes (find stray whitespace)
~/.vault_prod | od -c | tail -3

# Run with explicit, labeled vault IDs
ansible-playbook -i inventory.ini site.yml \
  --vault-id dev@~/.vault_dev --vault-id prod@~/.vault_prod

# Rotate a password across a file
ansible-vault rekey group_vars/prod/vault.yml

Conclusion

Decryption failed (no vault secrets were found that could decrypt) means the encrypted data is there but no available secret can open it. It is almost always a credential or vault-ID problem, not corruption. The usual root causes:

1. No vault password supplied to the run at all.
2. The supplied password is wrong or was rotated.
3. The file’s labeled vault ID is not among the IDs the run provides.
4. A password file emits extra whitespace or an error instead of the secret.
5. The ciphertext is genuinely corrupted (merge conflict, truncation).

Read the header to learn the required vault ID, prove the password with ansible-vault view, and make sure every ID an encrypted file needs has a matching secret in both dev and CI — that turns a hard abort into a clean, repeatable decrypt.