I inherited a project where all database users have the same password (bad!), this is stored in an Ansible Vault (good). I want to modify the roles so that I can store a unique password for every user in the vault.

Vault:

---
DB_USER: secretpass

Vars:

mysql_remote_users_enabled:
  - user: user1
    host: ip_address1
  - user: user2
    host: ip_address2

Task:

  - name: "mysql remote users present"
    mysql_user:
      login_user: root
      login_password: "{{ mysql_root_passwd }}"
      name: "{{ remote_user.user }}"
      host: "{{ remote_user.host }}"
      password: "{{ DB_PASS }}"
      state: present
    with_items:
      "{{ mysql_remote_users_enabled }}"
    loop_control:
        loop_var:
            remote_user

Is it possible to access vault vars in a dynamic way?