diff --git a/knowledge base/ansible.md b/knowledge base/ansible.md
index cfaac8f..25484c1 100644
--- a/knowledge base/ansible.md
+++ b/knowledge base/ansible.md
@@ -743,7 +743,7 @@ to use specific secrets or password managers.
### Ansible Vault
-Refer [Protecting sensitive data with Ansible Vault] and [Ansible Vault tutorial].
+Refer [Protecting sensitive data with Ansible Vault], [Ansible Vault tutorial] and [Ansible Vault with AWX].
Vault encrypts variables and files **at rest** and allows for their use in playbooks and roles.
It does **not** prevent tasks to print out data **in use**. See the
@@ -753,8 +753,21 @@ sensible values.
Protected data **will** require one or more passwords to encrypt and decrypt.
If storing vault passwords in third-party tools, one will need them need to allow for non-interactive access.
-Create and view protected data by using the `ansible-vault` command.
-Use the `ansible.cfg` file to specify the location of a password file or to always prompt for the password.
+Create and view protected data by using the `ansible-vault` command.
+
+Provide the Vault's password:
+
+- By using command line options.
+ Make ansible ask for it using `‑‑ask‑vault‑pass`, or provide a file containing it with `--vault-password-file`.
+- By using the `ansible.cfg` file to either always prompt for the password, or to specify the default location of the
+ password file:
+
+ ```ini
+ [defaults]
+ vault_password_file = password_file.txt
+ ```
+
+- By exporting the `ANSIBLE_VAULT_PASSWORD_FILE` environment variable to specify the location of the password file.
Vault passwords can be any string, and there is currently no special command to create one.
One must provide the/a Vault password **every time one encrypts and/or decrypts data** with Vault.
@@ -775,7 +788,7 @@ To encrypt tasks or other content, one must encrypt the entire file.
Input files are encrypted in-place unless one specifies the output files in the command.
-
+
Encrypt and use variables
1. Encrypt the variable's value:
@@ -839,7 +852,7 @@ Input files are encrypted in-place unless one specifies the output files in the
-
+
Encrypt and use existing files
1. Encrypt the file:
@@ -876,7 +889,7 @@ Input files are encrypted in-place unless one specifies the output files in the
Decrypt files with `ansible-vault decrypt 'path/to/file'`.
Input files are decrypted in place unless one specifies the output files in the command.
-
+
Decrypt files
```sh
@@ -893,7 +906,7 @@ Decryption successful
One can quickly view the content of encrypted files with `ansible-vault view 'path/to/file'`:
-
+
View encrypted files' content
```sh
@@ -1271,6 +1284,7 @@ Solution: use a version of `ansible-core` lower than 2.17.
- [Execution environment definition]
- [Protecting sensitive data with Ansible vault]
- [Ansible Vault tutorial]
+- [Ansible Vault with AWX]