title: Ansible: How to encrypt some variables in an inventory file in a separate vault file?
body: <h1>The settings</h1>
  
  <p>Consider an <a href="http://docs.ansible.com/intro_inventory.html" rel="noreferrer">Ansible inventory file</a> similar to the following example:</p>
  
  <pre><code>[san_diego]
  host1
  host2
  
  [san_francisco]
  host3
  host4
  
  [west_coast]
  san_diego
  san_francisco
  
  [west_coast:vars]
  db_server=foo.example.com
  db_host=5432
  db_password=top secret password
  </code></pre>
  
  <h1>The problem</h1>
  
  <p>I would like to store some of the vars (like <code>db_password</code>) in an <a href="https://docs.ansible.com/playbooks_vault.html" rel="noreferrer">Ansible vault</a>, but not the entire file.</p>
  
  <p>How can a vault-encrypted ansible file be imported into an unencrypted inventory file?</p>
  
  <h1>What I've tried</h1>
  
  <p>I have created an encrypted vars file and tried importing it with:</p>
  
  <pre><code>include: secrets
  </code></pre>
  
  <p>To which <code>ansible-playbook</code> responded with:</p>
  
  <pre><code>ERROR: variables assigned to group must be in key=value form
  </code></pre>
  
  <p>Probably because it tried to parse the <code>include</code> statement as a variable.</p>