Where to put ansible-vault password
The idea is to put all our sensitive data [...]


The meaning of "all" in this sentence should be analyzed very carefully before implementing the solution that you plan.

Ansible vault is a very useful tool, but it should be used only to store secrets that are:


Specifically needed for the ansible deployments
Easily made useless to owners that should become unaware of them, but that may illegitimately "remember" them (typically off-boarded employees)


The second point is critical.

Many people, and potentially the whole DevOps team, will have access to the ansible vault password and therefore all the secrets.

Therefore, for all the secrets stored in the vault, a condition should hold for which a person or machine with unauthorized access to them should be incapable of making any use of them if so is desired.

In concrete terms, if you use ansible to deploy a database and its users, you can store the passwords in the vault, but you will have to be very careful (and most likely consider another solution) if that service will be available from the Internet and without the need for any VPN authentication!

Users (DevOps) exposed to the secret, should be incapable of using "remembered" passwords if one security barrier is imposed on them (e.g., VPN access revoked). In addition to this, access to the source code repository (where the vault is stored) should be revoked as well before passwords are changed.

Under these conditions, ansible vault is a very useful tool.

Trying to store a secret that could be used by any person or machine on the Internet in the vault would be instead a mistake (e.g., VPN credentials of users).


  Is there any other options, which is the best (and secure) way to store ansible-vault password


Under the conditions from the previous paragraph, I think that a good practice would be:


Store the vault password in an external secure vault (something like Vault from HashiCorp or any SaaS for credentials management)
Allow access to the external vault item to DevOps (they will need the password for testing) and the CI/CD system or ansible controller
Keep a convention to use secrets! You will not be able to review changes to the secrets and you will not be able to grep for ansible variables in secrets files! So be thorough since the beginning. A good convention is to name all variables stored in the ansible vault with a secret_ prefix. When you will see something like:

postgres.yml:

postgres_password: "{{ secret_postgres_password }}"


you will know that the value is stored in the ansible vault.