{"record":{"id":"60d41a917e8c193e","repo":"ansible/ansible","slug":"did-not-find-a-match-for-encrypt-vault-id-s-in","errorCode":null,"errorMessage":"Did not find a match for --encrypt-vault-id=%s in the known vault-ids %s","messagePattern":"Did not find a match for --encrypt-vault-id=(.+?) in the known vault-ids (.+?)","errorType":"validation","errorClass":"AnsibleVaultError","httpStatus":null,"severity":"error","filePath":"lib/ansible/parsing/vault/__init__.py","lineNumber":559,"sourceCode":"\n\ndef match_encrypt_vault_id_secret(secrets, encrypt_vault_id=None):\n    # See if the --encrypt-vault-id matches a vault-id\n    display.vvvv(u'encrypt_vault_id=%s' % to_text(encrypt_vault_id))\n\n    if encrypt_vault_id is None:\n        raise AnsibleError('match_encrypt_vault_id_secret requires a non None encrypt_vault_id')\n\n    encrypt_vault_id_matchers = [encrypt_vault_id]\n    encrypt_secret = match_best_secret(secrets, encrypt_vault_id_matchers)\n\n    # return the best match for --encrypt-vault-id\n    if encrypt_secret:\n        return encrypt_secret\n\n    # If we specified a encrypt_vault_id and we couldn't find it, dont\n    # fallback to using the first/best secret\n    raise AnsibleVaultError('Did not find a match for --encrypt-vault-id=%s in the known vault-ids %s' % (encrypt_vault_id,\n                                                                                                          [_v for _v, _vs in secrets]))\n\n\ndef match_encrypt_secret(secrets, encrypt_vault_id=None):\n    \"\"\"Find the best/first/only secret in secrets to use for encrypting\"\"\"\n\n    display.vvvv(u'encrypt_vault_id=%s' % to_text(encrypt_vault_id))\n    # See if the --encrypt-vault-id matches a vault-id\n    if encrypt_vault_id:\n        return match_encrypt_vault_id_secret(secrets,\n                                             encrypt_vault_id=encrypt_vault_id)\n\n    # Find the best/first secret from secrets since we didn't specify otherwise\n    # ie, consider all the available secrets as matches\n    _vault_id_matchers = [_vault_id for _vault_id, dummy in secrets]\n    best_secret = match_best_secret(secrets, _vault_id_matchers)\n\n    # can be empty list sans any tuple","sourceCodeStart":541,"sourceCodeEnd":577,"githubUrl":"https://github.com/ansible/ansible/blob/9cf16a4aca7898481c257f1e17ad28d0b67b1f85/lib/ansible/parsing/vault/__init__.py#L541-L577","documentation":"Raised by match_encrypt_vault_id_secret() in lib/ansible/parsing/vault/__init__.py when encrypting with an explicit --encrypt-vault-id that matches none of the loaded vault identities. Unlike the best-secret path, it deliberately refuses to fall back to the first/other available secret, because the user explicitly named the identity to encrypt with. The message lists the known vault-ids for diagnosis.","triggerScenarios":"Running ansible-vault encrypt --encrypt-vault-id prod ... when the only loaded secrets have ids like 'default' or 'staging'; a typo in the id; the @source for that id failing to load so it never registers; using match_encrypt_vault_id_secret() programmatically with a secrets mapping lacking the id.","commonSituations":"CI pipelines parameterized with a vault-id label that differs from the provisioned one; renaming identities without updating pipelines; the password source for the named id silently failing earlier (bad file path) so the id never enters the secrets list.","solutions":["List the ids you actually loaded and correct the --encrypt-vault-id value to one of them (the error message prints the known ids).","Ensure a secret source for that id is provided: --vault-id prod@prod-pass.txt so 'prod' is registered before encrypting.","If the id source failed to load (missing file, script error), fix that first — the id is absent because its secret never loaded.","Or drop --encrypt-vault-id to use the default best-secret selection."],"exampleFix":"# before\nansible-vault encrypt secret.yml --encrypt-vault-id prod   # only 'default' loaded\n# after\nansible-vault encrypt secret.yml --encrypt-vault-id prod --vault-id prod@prod-pass.txt","handlingStrategy":"validation","validationCode":"known_ids = {v for v, _vs in secrets}  # same shape as match_* helpers\nif encrypt_vault_id not in known_ids:\n    raise ValueError(f'--encrypt-vault-id {encrypt_vault_id!r} not loaded; known ids: {sorted(known_ids)}')\nfrom ansible.parsing.vault import match_encrypt_vault_id_secret\nsecret = match_encrypt_vault_id_secret(secrets, encrypt_vault_id)","typeGuard":null,"tryCatchPattern":"from ansible.parsing.vault import AnsibleVaultError\ntry:\n    secret = match_encrypt_vault_id_secret(secrets, encrypt_vault_id='prod')\nexcept AnsibleVaultError as e:\n    raise ConfigError('load a secret source for vault-id prod (e.g. --vault-id prod@file) before encrypting') from e","preventionTips":["Always pair --encrypt-vault-id NAME with a loaded --vault-id NAME@source.","Centralize vault-id labels in one env config to prevent typo drift between environments.","Fail fast in CI: assert the requested encrypt id is present in the loaded secret list before running ansible-vault."],"tags":["ansible","vault","vault-id","encryption","configuration"],"backgroundTag":null,"analyzedSha":"9cf16a4aca7898481c257f1e17ad28d0b67b1f85","analyzedAt":"2026-08-15T00:15:47.100Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}