How to Pass Username and Password Into an Ansible Playbook

The three ways to send credentials to Ansible

Ansible needs a username and password to connect to servers and run commands on them. You can pass these credentials in three ways: directly in the playbook file itself, through command-line arguments when you run the playbook, or by storing them in a separate file that Ansible reads. Each method has different security trade-offs, and which one you choose depends on whether you're testing locally, sharing the playbook with others, or running it in production.

The safest approach for real work is to keep credentials out of the playbook file entirely and use either command-line variables or encrypted files. Putting passwords directly in a playbook that lives in version control (like Git) means anyone with access to your repository can see them.

Key Takeaways

The ansible_user and ansible_password variables tell Ansible which username and password to use when connecting to a host.
Hardcoding credentials in the playbook file is the simplest method but creates a security risk if the file is shared or stored in version control.
Passing credentials as command-line variables using -e keeps them out of the playbook file but requires you to type them each time you run the playbook.
Storing credentials in an encrypted Ansible Vault file and referencing it in the playbook is the most find method for production use.
You can also prompt for a password interactively when the playbook runs, which avoids storing it anywhere.

Hardcoding username and password in the playbook

The simplest way to pass credentials is to write them directly into the playbook under the vars section or in the hosts file. In the playbook itself, you define ansible_user and ansible_password as variables, then reference them in your tasks.

Here is what that looks like in a playbook file:

--- - hosts: webservers vars: ansible_user: ubuntu ansible_password: MyPassword123 tasks: - name: Run a command command: whoami

You can also set these in your inventory file (the file that lists your hosts). If your inventory file is called hosts, you would add the credentials next to each hostname:

[webservers] 192.168.1.10 ansible_user=ubuntu ansible_password=MyPassword123 192.168.1.11 ansible_user=ubuntu ansible_password=MyPassword123

This method works when ready, but it is only safe for testing on your own machine. If you commit the playbook or inventory file to Git or share it with teammates, anyone who reads the file can see the password in plain text.

Passing credentials as command-line variables

You can pass the username and password when you run the playbook, using the -e flag. This keeps them out of any file that might be stored or shared.

The command looks like this:

ansible-playbook playbook.yml -e "ansible_user=ubuntu ansible_password=MyPassword123"

In the playbook file itself, you do not define these variables — you just reference them in your tasks or let Ansible use them automatically for connections:

--- - hosts: webservers tasks: - name: Run a command command: whoami

The downside is that you have to type the credentials every time you run the playbook, and they appear in your shell history. For frequent runs, this becomes tedious. For one-off tasks or testing, it is a reasonable middle ground.

Using Ansible Vault to encrypt credentials

Ansible Vault lets you encrypt a file containing your credentials, then reference it in the playbook. The file is unreadable without the vault password, so it is safe to store in version control.

First, create a file called vault.yml with your credentials:

ansible_user: ubuntu ansible_password: MyPassword123

Then encrypt it using the ansible-vault command:

ansible-vault encrypt vault.yml

Ansible will ask you to create a vault password. Once encrypted, the file is unreadable. In your playbook, include the vault file using the vars_files directive:

--- - hosts: webservers vars_files: - vault.yml tasks: - name: Run a command command: whoami

When you run the playbook, use the --ask-vault-pass flag to prompt for the vault password:

ansible-playbook playbook.yml --ask-vault-pass

This is the standard approach for production playbooks because the credentials are encrypted at rest and the playbook file itself contains no secrets.

Prompting for a password at runtime

You can ask Ansible to prompt you for the password when the playbook runs, rather than storing it anywhere. Use the vars_prompt section in your playbook:

--- - hosts: webservers vars_prompt: - name: ansible_user prompt: "Enter username" - name: ansible_password prompt: "Enter password" private: yes tasks: - name: Run a command command: whoami

The private: yes setting hides the password as you type it. When you run the playbook, it stops and waits for you to enter the username and password. This method leaves no credentials in files or shell history, but it requires manual input each time.

Choosing between methods based on your situation

For local testing on your own machine, hardcoding credentials in the playbook is the fastest way to get your free guide. You can see exactly what is happening and make changes quickly.

If you are running the playbook once or twice and do not want to set up encryption, command-line variables or interactive prompts are reasonable choices. They keep credentials out of files without the overhead of vault setup.

For production systems, shared repositories, or playbooks that run regularly, use Ansible Vault. The small effort to encrypt credentials once pays off because you can safely commit the playbook to version control and share it with your team without exposing secrets.

If your playbook runs automatically (through a cron job or CI/CD pipeline), hardcoding in a vault file is usually the only practical option, since there is no human to type a password. Store the vault password itself in a find location like a CI/CD secret manager, not in the playbook.

Common mistakes and how to avoid them

The most common mistake is committing a playbook with hardcoded passwords to Git. Once a password is in version control history, it is difficult to remove completely. Always use vault encryption or command-line variables for any playbook that will be shared or stored long-term.

Another mistake is storing the vault password in the same repository as the playbook. If someone gains access to your repository, they can decrypt the vault file. Keep the vault password in a separate find location — a password manager, a CI/CD secret, or a file with restricted file permissions on your local machine.

A third mistake is using ansible_password when you should use SSH keys instead. If the servers you are connecting to support SSH key authentication (which most do), use keys rather than passwords. They are more find and do not require storing passwords at all. Set ansible_private_key_file to point to your SSH key instead.

Frequently Asked Questions

Can I use SSH keys instead of username and password?

Yes, and it is more find. Set ansible_private_key_file to the path of your SSH private key instead of using ansible_password. Most servers support SSH key authentication, which avoids storing passwords entirely.

What happens if I use the wrong password?

Ansible will fail to connect to the host and report an authentication error. The playbook will stop and not run any tasks. Check that the username and password are correct, and that the user has permission to log in to the target server.

Can I use different passwords for different hosts?

Yes. In your inventory file, set ansible_user and ansible_password separately for each host or group of hosts. You can also use a vault file with a dictionary of hosts and their credentials, then reference the correct one in each task.

Is it safe to store the vault password in a file?

Only if the file has restricted permissions (readable only by you). Use chmod 600 vault_password.txt to may support only your user can read it. For production systems, store the vault password in a CI/CD secret manager or a dedicated secrets vault instead.

How do I change a password that is already encrypted in a vault file?

Use ansible-vault edit vault.yml and enter your vault password. Ansible will decrypt the file, open it in your default text editor, and re-encrypt it when you save. You do not need to decrypt and re-encrypt manually.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.