# dumping host\_vars - how do I filter out sensitive data?

**URL:** <https://forum.ansible.com/t/dumping-host-vars-how-do-i-filter-out-sensitive-data/17678>\
**Category:** Ansible Project\
**Created:** [March 5, 2015, 3:23pm UTC](https://forum.ansible.com/t/dumping-host-vars-how-do-i-filter-out-sensitive-data/17678 "2015-03-05T15:23:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Larry\_Fast](https://avatars.discourse-cdn.com/v4/letter/l/b3f665/32.png) [@Larry\_Fast](https://forum.ansible.com/u/Larry_Fast)\
**Post date:** [March 5, 2015, 3:23pm UTC](https://forum.ansible.com/t/dumping-host-vars-how-do-i-filter-out-sensitive-data/17678/1 "2015-03-05T15:23:58Z")

</div>

I’m using the following jinja2 code to dump my hostvars for diagnostics {{ hostvars | to\_nice\_json }}

I would like to pre-filter this dump to exclude sensitive data. I can manage a list of sensitive values but is there a way to scan the hostvars dict and blank out some variables?

---

<div class="post-metadata">

**Author:** ![vaida.dan](https://avatars.discourse-cdn.com/v4/letter/v/5daacb/32.png) [@vaida.dan](https://forum.ansible.com/u/vaida.dan)\
**Post date:** [March 6, 2015, 9:39am UTC](https://forum.ansible.com/t/dumping-host-vars-how-do-i-filter-out-sensitive-data/17678/2 "2015-03-06T09:39:13Z")

</div>

I don’t think there’s a quick solution for this. I believe you’d need to write your own filter plugin: [http://docs.ansible.com/developing\_plugins.html#filter-plugins](http://docs.ansible.com/developing_plugins.html#filter-plugins)

---

<div class="post-metadata">

**Author:** ![Larry\_Fast](https://avatars.discourse-cdn.com/v4/letter/l/b3f665/32.png) [@Larry\_Fast](https://forum.ansible.com/u/Larry_Fast)\
**Post date:** [March 9, 2015, 7:13pm UTC](https://forum.ansible.com/t/dumping-host-vars-how-do-i-filter-out-sensitive-data/17678/3 "2015-03-09T19:13:07Z")

</div>

Thanks Dan,  
I like Ansible/Jinja2’s interfaces for writing custom filters. Easy work. As an example for others my code is below with some helpful references. Note: I’m a very junior Pythonian.

[http://docs.ansible.com/developing\_plugins.html#filter-plugins](http://docs.ansible.com/developing_plugins.html#filter-plugins)

> plugins can be shipped in a subdirectory relative to a top-level playbook, in folders named the same as indicated above. +1

[8.17. copy — Shallow and deep copy operations — Python 2.7.18 documentation](https://docs.python.org/2/library/copy.html) - deepcopy

> <https://stackoverflow.com/questions/3232943/update-value-of-a-nested-dictionary-of-varying-depth>

# ansible-python-jinja2 filter that removes sensitive data

# INPUT: dictionary - ie. Ansible’s hostvars dictionary that may contain passwords

# OUTPUT: A filtered copy of dict with

# sensitive data removed

# METHOD: Make a copy of the incoming dictionary (don’t touch the source)

# Recursively iterate through the whole tree

# Replaces sensitive values with the string “hidden by remove\_sensitive\_data jinja2 filter”

# Warning: I don’t think Lists are handled properly

# The purpose is updating named strings so this is OK for now

# Code Quality: poor - learning python and this is a spike

# Sensitive data fields are hard coded

# Future: The sensitive field list should be pulled from Ansible’s dict

import re  
import collections  
import yaml  
import copy

# Recursive traverse of the dict

# Calling update\_callback() for each element

# and stuffing the results back into the dict

def update\_dict(d, update\_callback):

# Check that d is a dictionary

if isinstance(d, collections.Mapping):  
for k, v in d.items():  
if isinstance(v, collections.Mapping):  
updated = update\_dict(v, update\_callback)  
d[k] = updated  
#print “D: %s” % k  
else:  
d[k] = update\_callback(k, v)  
#print “V: %s” % k

# always return d whether it was modified or not

return d

# This is the callback func that filters/not each value in the dict

def rm\_sensitive\_data(key, value):  
srchObj = re.search( r’ssh\_pass’, key )  
if( srchObj ):  
return ‘value hidden by remove\_sensitive\_data jinja2 filter’  
else:  
return value

def remove\_sensitive\_data(arg):

# Don’t change the original

mycopy = copy.deepcopy(arg)  
update\_dict( mycopy, rm\_sensitive\_data )  
return mycopy

class FilterModule(object):  
def filters(self):  
return {‘remove\_sensitive\_data’: remove\_sensitive\_data}