Fix Ansible Vault "No Vault Secrets Found"
The Error
ERROR! Attempting to decrypt but no vault secrets found
This happens when your playbook references vault-encrypted variables but you didn't provide the vault password.
Solution 1: Pass Password Interactively
ansible-playbook playbook.yml --ask-vault-pass
Solution 2: Use a Password File
# Create password file
echo 'my-vault-password' > ~/.vault_pass
chmod 600 ~/.vault_pass
# Use it
ansible-playbook playbook.yml --vault-password-file ~/.vault_pass
Set it permanently in ansible.cfg:
[defaults]
vault_password_file = ~/.vault_pass
Solution 3: Environment Variable
export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass
ansible-playbook playbook.yml
Solution 4: Multiple Vault IDs
# Encrypt with an ID
ansible-vault encrypt_string --vault-id dev@prompt 'secret_value' --name 'db_password'
# Decrypt with the same ID
ansible-playbook playbook.yml --vault-id dev@~/.vault_pass_dev
Common Mistakes
Encrypted File in Inventory
# Check if your inventory has encrypted content
head -1 inventory/group_vars/all.yml
# If it shows $ANSIBLE_VAULT;1.1;AES256, you need --ask-vault-pass
Wrong Password
ERROR! Decryption failed (no vault secrets would found that could decrypt)
This means the password is wrong, not missing. Double-check your vault password.
Quick Reference
# Encrypt a file
ansible-vault encrypt secrets.yml
# Decrypt a file
ansible-vault decrypt secrets.yml
# Edit encrypted file
ansible-vault edit secrets.yml
# Encrypt a single string
ansible-vault encrypt_string 'my_secret' --name 'variable_name'
# View encrypted file
ansible-vault view secrets.yml
Conclusion
Always provide the vault password via --ask-vault-pass, a password file, or the ANSIBLE_VAULT_PASSWORD_FILE environment variable. Set vault_password_file in ansible.cfg so you never forget.