# Are module, role and play argument validation the same? (argument\_spec) **URL:** \ **Category:** Get Help\ **Tags:** module, role, playbook\ **Created:** [February 22, 2026, 10:36pm UTC](https://forum.ansible.com/t/are-module-role-and-play-argument-validation-the-same-argument-spec/45377 "2026-02-22T22:36:42Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![mardonner](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mardonner/32/10390_2.png) [@mardonner](https://forum.ansible.com/u/mardonner)\ **Post date:** [February 22, 2026, 10:36pm UTC](https://forum.ansible.com/t/are-module-role-and-play-argument-validation-the-same-argument-spec/45377/1 "2026-02-22T22:36:42Z")
Hey, I recently discovered role argument validation and started to include `meta/argument_specs.yml` in my roles. Some of the input arguments of my role are sensitive values, so I was looking through the documentation to see whether something like `no_log` exists in this specification, since I’m not aware of any method to mark certain variables as sensitive. This is something I’m used to from terraform. I was afraid that the argument validation might print the sensitive values in case any of the role input arguments don’t comply with this spec and the validation fails. During my search, I discovered that there are three places where argument validation in form of `argument_spec` exists and I’m a little confused now. 1. [AnsibleModule](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_reuse_roles.html#role-argument-validation) 2. [Play Argument Validation](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_variables_validation.html#play-argument-validation) 3. [Role argument Validation](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_reuse_roles.html#role-argument-validation) The first one seems to be for module developers while the other two are for more for endusers like me. The latter two seem to just prepend a special task before the play/role runs ([ansible.builtin.validate\_argument\_spec](https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/validate_argument_spec_module.html#ansible-builtin-validate-argument-spec-module-validate-role-argument-specs)). The thing I’m asking myself now is whether all these variants are different or if they are actually the same thing. Are the latter two just subsets of the first one or do they have the same available keywords but it’s just not documented? Coming back to my the reason why I was searching for this initially, the argument spec in the AnsibleModule documentation has a `no_log` keyword. The others do not. It in fact has many more keywords that could be useful in a play and role argument\_spec, like `mutually_exclusive`. So, which keywords can actually be used in the `argument_spec` for my role? Only those [here](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_reuse_roles.html#specification-format) or also those [here](https://docs.ansible.com/projects/ansible/latest/dev_guide/developing_program_flow_modules.html#argument-spec)? ---
**Author:** ![kks](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kks/32/10352_2.png) [@kks](https://forum.ansible.com/u/kks)\ **Post date:** [February 23, 2026, 8:22am UTC](https://forum.ansible.com/t/are-module-role-and-play-argument-validation-the-same-argument-spec/45377/2 "2026-02-23T08:22:25Z")
> [@mardonner](#): > > `mutually_exclusive` This is not possible to have mutual exclusivity for role variables due to ansible variable visibility model. You cannot unset variables in ansible - so if you want var1 be set for host1 and var2 be set for host2 - and at the same time want them to be mutually exclusive this is not possible (in general) > [@mardonner](#): > > So, which keywords can actually be used in the `argument_spec` for my role? Only those [here](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_reuse_roles.html#specification-format) or also those [here](https://docs.ansible.com/projects/ansible/latest/dev_guide/developing_program_flow_modules.html#argument-spec)? First link [Roles — Ansible Community Documentation](https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_reuse_roles.html#specification-format) is for roles, you should use example there for argument\_specs.yml file > [@mardonner](#): > > The latter two seem to just prepend a special task before the play/role runs ([ansible.builtin.validate\_argument\_spec](https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/validate_argument_spec_module.html#ansible-builtin-validate-argument-spec-module-validate-role-argument-specs)). That is correct, but it should not stop anyone from adding your own argument validations with [ansible.builtin.validate\_argument\_spec](https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/validate_argument_spec_module.html#ansible-builtin-validate-argument-spec-module-validate-role-argument-specs) or ansible.builtin.assert, if you feel that you need additional validation. And you might need if it you validation depends on facts. > [@mardonner](#): > > Are the latter two just subsets of the first one or do they have the same available keywords but it’s just not documented? They are similar as per my understanding, maybe they use same checks somewhere deep. You got documentation links right, this is all documentation. You should be able to find plenty examples on github, search for ‘argument\_specs.yml’ ---
**Author:** ![bvitnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bvitnik/32/4132_2.png) [@bvitnik](https://forum.ansible.com/u/bvitnik)\ **Post date:** [February 23, 2026, 1:08pm UTC](https://forum.ansible.com/t/are-module-role-and-play-argument-validation-the-same-argument-spec/45377/3 "2026-02-23T13:08:38Z")
> [@kks](#): > > This is not possible to have mutual exclusivity for role variables due to ansible variable visibility model. You cannot unset variables in ansible - so if you want var1 be set for host1 and var2 be set for host2 - and at the same time want them to be mutually exclusive this is not possible (in general) I don’t see how this can be correct since validation is done per host. var1 and var2 are completely independent in your example. Visibility is thus limited to what a single host sees. ---
**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\ **Post date:** [February 23, 2026, 3:16pm UTC](https://forum.ansible.com/t/are-module-role-and-play-argument-validation-the-same-argument-spec/45377/4 "2026-02-23T15:16:07Z")
Variables have 2 scopes, per host and for playbook objects, the first is isolated per host (but still accessible via hostvars), the second is not and cannot be isolated, once defined all other contained playbook objects inherit them. ---
**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\ **Post date:** [February 23, 2026, 3:27pm UTC](https://forum.ansible.com/t/are-module-role-and-play-argument-validation-the-same-argument-spec/45377/5 "2026-02-23T15:27:35Z")
Role/play argument spec validation is a subset of module argument spec validation, and some keywords are unsupported/do nothing, so you should only use documented fields for role argument specifications. This is the surface area that is supported and tested. Supporting `no_log` for role/play variables would require a different mechanism than the one used by module arguments. There’s an open [feature request](https://github.com/ansible/ansible/issues/84498) for that. Supporting `mutually_exclusive` would be trivial (and works for suboptions already, although this was not intentional from my understanding, and is not tested/guaranteed to keep working). From the responses on [Role argument specification should support "mutually\_exclusive", "required\_if" and the other Module argument specification features · Issue #74995 · ansible/ansible · GitHub](https://github.com/ansible/ansible/issues/74995), it sounds like `mutually_exclusive` support was not added in hopes of improving the interface. ---
**Author:** ![mardonner](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mardonner/32/10390_2.png) [@mardonner](https://forum.ansible.com/u/mardonner)\ **Post date:** [February 23, 2026, 4:10pm UTC](https://forum.ansible.com/t/are-module-role-and-play-argument-validation-the-same-argument-spec/45377/6 "2026-02-23T16:10:57Z")
> [@shertel](#): > > Role/play argument spec validation is a subset of module argument spec validation, and some keywords are unsupported/do nothing, so you should only use documented fields for role argument specifications. This is the surface area that is supported and tested. Thank you, that clears up some things for me. > [@shertel](#): > > Supporting `no_log` for role/play variables would require a different mechanism than the one used by module arguments. There’s an open [feature request](https://github.com/ansible/ansible/issues/84498) for that. From my experiences so far, the [ansible.builtin.validate\_argument\_spec](https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/validate_argument_spec_module.html#ansible-builtin-validate-argument-spec-module-validate-role-argument-specs) task will not show any of the actual argument values that were supplied to the role if it fails. This was my primary reason for asking for `no_log`. I don’t want my sensitive values to be leaked in pipeline logs. I did not yet dive into the code myself yet but can any of you also confirm this? However, I’m not so sure if there might be other mechanism that might cause ansible to print these sensitive values (aside any verbosity flags). I usually supply them via `--extra-vars`. ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [February 23, 2026, 5:03pm UTC](https://forum.ansible.com/t/are-module-role-and-play-argument-validation-the-same-argument-spec/45377/7 "2026-02-23T17:03:27Z")
Two other important differences to note are: - Default values. These are only used for modules. For role and play argspecs, they are only used for showing them to the user when using `ansible-doc` etc. - Types. While for modules, values are coerced to the type (like a string `"12"` is converted to an integer `12` if `type="int"`, or a string `1,2,3` is converted to a list `[1.0, 2.0, 3.0]` if `type="list"` and `elements="float"`), this doesn’t happen for role and play argspecs. There, Ansible only makes sure that the values _can_ be coerced this way, but doesn’t do it. So if a parameter is expected to be a list, it could also happen to contain a single value (list of one element) or a string (should be split by comma). Both can cause quite some confusion, and especially the missing type conversion can easily trigger errors when the role/play author assumes that they can append two lists the user passed in - but then Ansible barfs (or computes an unexpected value) since the inputs aren’t actually lists. ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [March 25, 2026, 5:03pm UTC](https://forum.ansible.com/t/are-module-role-and-play-argument-validation-the-same-argument-spec/45377/8 "2026-03-25T17:03:57Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.