Ansible Vault

this document provides information on configuring {{futurex}} hardware security modules (hsms) with ansible vault using {{futurex}} pkcs#11 libraries for additional questions related to your hsm, see the relevant user guide about ansible vault ansible is an open source it automation tool developed by red hat it automates various it tasks, such as configuration management, application deployment, orchestration, and task automation ansible vault is a feature of ansible that enables you to encrypt sensitive data, such as passwords or keys, in encrypted files instead of plaintext ansible vault key features encrypt entire files (yaml, vars, inventories) encrypt individual variables using encrypt string support for multiple vault ids/keys (e g , dev vs prod) secure file operations edit, view, rekey cli automation support ( vault password file) avoids leaving decrypted data on disk (when used carefully) aes256 encryption by default fully integrated with ansible playbooks/workflows using hsms to protect ansible private keys ansible vault can work with private keys stored on hsms, which helps to prevent the disclosure of the keys and enables the secure usage of private keys to perform various functions with this integration, you can securely reference your private key stored in an hsm to perform automated encryption and decryption tasks using ansible playbooks with the {{futurex}} pkcs #11 library, {{pkcs11 provider}} by latchset, and openssl guardian integration the {{guard}} introduces mission critical viability to core cryptographic infrastructure, including centralization of device management elimination of points of failure distribution of transaction loads group specific function blocking user defined grouping systems see the applicable guide in the {{futurex}} portal for configuring hsms with the {{guard}} , including pkcs #11 and cng configuration