How Secure Are Ansible Vaults?
Encrypting credentials like SSH keys or database passwords and putting the encrypted file in a semi-public Git repository is both convenient and scary. Convenient because every user of the repository only has to know only one password. Scary because you now rely on encryption and passwords instead of other security practices. So the question arose in my team “Assuming there are no implementation errors, how secure are Ansible Vaults?" Since the first 10 Google results did not answer this question quick enough, I decided to read the source code and answer the question myself.