A playbook loads vars/secret.yml, created with ansible-vault create. Walk through creating the secret and running the playbook with ansible-playbook.

Create the encrypted file with ansible-vault create playbooks/vars/secret.yml and put web_pass: ... in it. Then run --syntax-check and the playbook itself, both with --ask-vault-pass. Without that flag even the syntax check fails with "no vault secrets found".

1. Create the directory and the encrypted file.

   $ mkdir playbooks/vars
   $ ansible-vault create playbooks/vars/secret.yml
   New Vault password: ****
   Confirm New Vault password: ****
   

   In the editor, add web_pass: <password>, save and close. On disk the file is now ciphertext.

2. Syntax check without the password fails:

   [ERROR]: Error reading `vars_files` file 'vars/secret.yml':
   Attempting to decrypt but no vault secrets found.
   

   Loading the play means reading its vars_files, and that needs the key.

3. Syntax check with the password succeeds:

   $ ansible-playbook --syntax-check playbooks/playbook-vars-httpd.yml --ask-vault-pass
   

4. Run it the same way; the final debug task shows the page content, for example web1.example.com (10.176.118.15) ....

--vault-id @prompt works the same way as --ask-vault-pass.

Go deeper:

• Using encrypted variables and files (official docs) — --ask-vault-pass, --vault-id and password files at run time.