How do you use several vault passwords in one run, and what is a vault ID for?

Pass one --vault-id per password, for example --vault-id one@prompt --vault-id two@prompt. A vault ID is a label attached to a file when you encrypt it (--vault-id dev@prompt). At run time Ansible tries the password with the matching label first, instead of trying every password on every file.

* The vault ID in the file header tells Ansible which password to try first. *

$ ansible-navigator run -m stdout --pae false site.yml \
    --vault-id one@prompt --vault-id two@prompt
Vault password (one):
Vault password (two):

Why several passwords at all? To separate trust levels: developers may hold the dev password but not the prod one, so they can run against test systems without ever being able to decrypt production secrets.

The label before @ is free to choose, and it can be left out: --vault-id @prompt is short for default@prompt. The part after @ is the source: prompt for an interactive question, or a file path or script that supplies the password.

Go deeper:

• Managing multiple passwords with vault IDs (official docs) — labels, sources and how matching works.