using ansible vault from within a playbook

[smkr]

Scenario: generate a random password, save it into a config file, encrypt the
file with ansible-vault then use it to configure db user password on remote.

I'd like this to happen in an automatic manner but when calling 'ansible-vault'
from within the task it goes into "waiting mode" -- prompting for the password
I'm guessing. I do call the playbook with '--ask-vault-pass'.

Perhaps my approach to the solving the problem needs to be changed. I could use
GPG but would like to stick to Ansible native tools. Any suggestions?

--
Steve