Ansible "Attempting to decrypt but no vault secrets found" in CI

By Kaveh Alemi·Latchkey

A play uses vault-encrypted vars or files, but the runner has no vault password configured, so Ansible cannot decrypt them and aborts.

What this error means

ansible-playbook fails with "Attempting to decrypt but no vault secrets found" (or "Decryption failed"). It works locally where the vault password is configured but fails on a runner that has none.

ansible

ERROR! Attempting to decrypt but no vault secrets found

# or a wrong password:
ERROR! Decryption failed (no vault secrets were found that could decrypt) on
/runner/_work/repo/group_vars/all/vault.yml

Common causes

No vault password on the runner

No --vault-password-file, ANSIBLE_VAULT_PASSWORD_FILE, or --ask-vault-pass is provided, so encrypted content cannot be opened.

Wrong password or vault id

A mismatched password, or a missing --vault-id for multi-vault setups, fails decryption.

How to fix it

Provide the vault password from a secret

Write the password to a file from a CI secret and reference it; never commit it.

.github/workflows/ci.yml

printf '%s' "${{ secrets.ANSIBLE_VAULT_PASSWORD }}" > /tmp/.vault_pass
chmod 600 /tmp/.vault_pass
ansible-playbook -i inventory site.yml \
  --vault-password-file /tmp/.vault_pass

Match the password and vault id

Confirm the password decrypts the file locally.
For multi-vault setups, supply the correct --vault-id label.
Ensure the password file has restrictive permissions.

How to prevent it

Inject the vault password from a CI secret into a password file.
Use ANSIBLE_VAULT_PASSWORD_FILE or --vault-password-file in CI.
Use --vault-id labels for multi-vault projects.

Frequently asked questions

What causes "Ansible vault password required"?