# Ansible vault logs sensitive information when verbose **URL:** \ **Category:** Ansible Project\ **Created:** [February 9, 2015, 6:20pm UTC](https://forum.ansible.com/t/ansible-vault-logs-sensitive-information-when-verbose/17477 "2015-02-09T18:20:52Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![James\_Morgan1](https://avatars.discourse-cdn.com/v4/letter/j/57b2e6/32.png) [@James\_Morgan1](https://forum.ansible.com/u/James_Morgan1)\ **Post date:** [February 9, 2015, 6:20pm UTC](https://forum.ansible.com/t/ansible-vault-logs-sensitive-information-when-verbose/17477/1 "2015-02-09T18:20:52Z")
Hi, I have some sensitive data (keys and pass files etc) stored in yaml var files and encrypted with the vault. Just noticed that if I have -v set it prints out the contents when I import the var files. I would have expected the facts to know that the file its loading was from the vault and the contents should not be logged TASK: [user-builder | Add builder public key to authorized\_keys for deployment of code to jump servers] \*\*\* changed: [localhost] =\> (item=ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA3ed3cnj1HNPS60Hazeilt3yA8Doljw+zlhlDsvd30k3pPkmudlD+ZNNEoo2hNluUVZnlQX+ej9qUpz/uTK8cx9o5MgcyWIpJRAhsm2DKjjQxGQxiNyi3cAAAAB3NzaC1yc2EAAAABIwAAAQEA3ed3cnj1HNkmudlD+ZNNEoo2hNluUVZnlQX+ej9qUpz/uTK8cx9o5MgcyWIpJRAhsm2DKjjQxGQxiNyi3ccAruWODdu8/9+VzWLEHsOH3GnSTsJ2+ULTvvhnjDAjeTwiPC05pwgZbdgg+nuvVV7q919v8n/1NNUVY9Kw3RUGHq36MoyvYwzb6hA5UoN/3MjqoXGn", “key\_options”: null, “keyfile”: “…/builder/.ssh/authorized\_keys”, “manage\_dir”: true, “path”: null, “state”: “present”, “unique”: false, “user”: “builder”} Thanks James ---
**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\ **Post date:** [February 10, 2015, 4:30am UTC](https://forum.ansible.com/t/ansible-vault-logs-sensitive-information-when-verbose/17477/2 "2015-02-10T04:30:11Z")
Hi James, Could you open a github issue for this so we can keep track of it? In the mean time, you can use the `no_log: yes` option on a per-task basis to ensure sensitive information is not logged. Thanks! ---
**Author:** ![James\_Morgan1](https://avatars.discourse-cdn.com/v4/letter/j/57b2e6/32.png) [@James\_Morgan1](https://forum.ansible.com/u/James_Morgan1)\ **Post date:** [February 10, 2015, 7:07am UTC](https://forum.ansible.com/t/ansible-vault-logs-sensitive-information-when-verbose/17477/3 "2015-02-10T07:07:17Z")
Sure will do. Thanks James ---
**Author:** ![Tomasz\_Kontusz](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@Tomasz\_Kontusz](https://forum.ansible.com/u/Tomasz_Kontusz)\ **Post date:** [February 10, 2015, 8:22am UTC](https://forum.ansible.com/t/ansible-vault-logs-sensitive-information-when-verbose/17477/4 "2015-02-10T08:22:04Z")
It’s not “printing the content”, it’s logging loop items. You’ll want to move the sensitive data into dictionaries and use with\_dict, or iterate over list indexes with with\_sequence. It would be nice if Ansible somehow marked sensitive data, but it’s not doing it now. James Cammarata [jcammarata@ansible.com](mailto:jcammarata@ansible.com) napisał: ---
**Author:** ![James\_Morgan1](https://avatars.discourse-cdn.com/v4/letter/j/57b2e6/32.png) [@James\_Morgan1](https://forum.ansible.com/u/James_Morgan1)\ **Post date:** [February 10, 2015, 9:06am UTC](https://forum.ansible.com/t/ansible-vault-logs-sensitive-information-when-verbose/17477/5 "2015-02-10T09:06:24Z")
Hi, Sorry I don’t think my example was good enough. It was logging when using include\_vars. I will create an example playbook and raise a defect on github TASK: [user-builder | include\_vars vault/keys.yml] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ok: [localhost] =\> {“ansible\_facts”: {“vault\_builder\_id\_rsa”: “-----BEGIN RSA PRIVATE KEY----- …\7f0iXxEglf8a3wGD3qEVCNLNDxzVJ6grnFsDa0IfBey\n3VG7Sawu3vkpf0jnd21knv90YspfEx3zjGHpM2inT4AfVM8vjMAxgF9w3jZIj2w2\n2D47yPaF2xv8PvasNCEHcs7vCKd2AqtU5ySqb9ajJzvZE7jwqQE=\n-----END RSA PRIVATE KEY-----\n”}} TASK: [user-builder | include\_vars vault/cvs.yml] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ok: [localhost] =\> {“ansible\_facts”: {“vault\_builder\_cvspass”: “/1 …n”}} TASK: [user-builder | include\_vars vault/subversion.yml] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ok: [localhost] =\> {“ansible\_facts”: {“vault\_builder\_subversion\_cert\_data”: “K 10\nascii\_cert\nV 948\nMIICwzCCAiwCCQC7AE/MsC2l8jANBgkqhkiG9w0BAQUFADCDVQQHEwZEdWJsaW4xFzAVBgNVBAoTDlBhZGR5IFBvd2VyIElUMQwwCgYDVQQLEwNTQ00xKDAmBgNVBAMTH2R1YmRjqT6r0Dta59bA9kiVqzI\nK 8\nfailures\nV 2\n12\nK 15\nsvn:realmstring\nV 27\n[https://217.112.150.122:443](https://217.112.150.122:443)\nEND\n”, “vault\_builder\_subversion\_serverrecord”: “29c985a08edc7fae1dde0fe590b47938”}} J ---
**Author:** ![James\_Morgan1](https://avatars.discourse-cdn.com/v4/letter/j/57b2e6/32.png) [@James\_Morgan1](https://forum.ansible.com/u/James_Morgan1)\ **Post date:** [February 10, 2015, 9:57am UTC](https://forum.ansible.com/t/ansible-vault-logs-sensitive-information-when-verbose/17477/6 "2015-02-10T09:57:57Z")
I have raised [https://github.com/ansible/ansible/issues/10194](https://github.com/ansible/ansible/issues/10194) I’ll raise issues on github next time before I post to the forum. I wasn’t aware of the etiquette, apologies James ---
**Author:** ![Toshio\_Kuratomi](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@Toshio\_Kuratomi](https://forum.ansible.com/u/Toshio_Kuratomi)\ **Post date:** [February 10, 2015, 10:28pm UTC](https://forum.ansible.com/t/ansible-vault-logs-sensitive-information-when-verbose/17477/7 "2015-02-10T22:28:07Z")
It can be good to raise issues on the forum too. Sometimes the forum/mailing list is helpful for figuring out if the issue is really a bug or to get feedback on potential implementation of fixes. -Toshio ---
**Author:** ![James\_Morgan1](https://avatars.discourse-cdn.com/v4/letter/j/57b2e6/32.png) [@James\_Morgan1](https://forum.ansible.com/u/James_Morgan1)\ **Post date:** [February 12, 2015, 10:08am UTC](https://forum.ansible.com/t/ansible-vault-logs-sensitive-information-when-verbose/17477/8 "2015-02-12T10:08:55Z")
Thanks Toshio, will do in the future.