# Hide secrets from output

**URL:** <https://forum.ansible.com/t/hide-secrets-from-output/27103>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [March 24, 2018, 8:14am UTC](https://forum.ansible.com/t/hide-secrets-from-output/27103 "2018-03-24T08:14:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\
**Post date:** [March 24, 2018, 8:14am UTC](https://forum.ansible.com/t/hide-secrets-from-output/27103/1 "2018-03-24T08:14:02Z")

</div>

As far as I can see, some modules implement a special “VALUE\_SPECIFIED\_IN\_NO\_LOG\_PARAMETER” for some attributes, which cause them to be hidden from output, which is great.

However, I’d like to control this outside of modules. A use case is for example a playbook doing things:

- name: Get AWS credentials  
set\_fact:  
aws\_creds: “{{ lookup(‘passwordstate’, aws\_iam\_ansible\_passwordstate\_id) }}”

- name: Grab username and password from creds  
set\_fact:  
aws\_access\_key: “{{ aws\_creds[‘username’] }}”  
aws\_secret\_key: “{{ aws\_creds[‘password’] }}”

I want to be able to flag parameters as “globally hidden”, not just as module outputs. I know I can use no\_log, but that would hide _all_ output from a step, which makes it hard to troubleshoot stuff (this is what we’re doing today, and having to temporarily turn off the no\_log flag when troubleshooting is a headache.

Is there anyway to (for example) set ansible.cfg to always hide the value of variables called aws\_access\_key, regardless of playbook/play/task/role?

---

<div class="post-metadata">

**Author:** ![Tchia04](https://avatars.discourse-cdn.com/v4/letter/t/fbc32d/32.png) [@Tchia04](https://forum.ansible.com/u/Tchia04)\
**Post date:** [March 24, 2018, 9:17pm UTC](https://forum.ansible.com/t/hide-secrets-from-output/27103/2 "2018-03-24T21:17:07Z")

</div>

You can use a custom callback plugin to mask the password. An example can be found at [https://serverfault.com/questions/754860/how-can-i-reduce-the-verbosity-of-certain-ansible-tasks-to-not-leak-passwords-in/897480#897480?newreg=03468dbbc6174dbc9d04455112ec29a7](https://serverfault.com/questions/754860/how-can-i-reduce-the-verbosity-of-certain-ansible-tasks-to-not-leak-passwords-in/897480#897480?newreg=03468dbbc6174dbc9d04455112ec29a7)

---

<div class="post-metadata">

**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\
**Post date:** [March 24, 2018, 9:26pm UTC](https://forum.ansible.com/t/hide-secrets-from-output/27103/3 "2018-03-24T21:26:32Z")

</div>

Thanks,  
I’ll do that!