# How to use an inventory variable in a lookup of aws secret?

**URL:** <https://forum.ansible.com/t/how-to-use-an-inventory-variable-in-a-lookup-of-aws-secret/7255>\
**Category:** Get Help\
**Tags:** variables, playbook, aws, jinja2, ansible-core\
**Created:** [July 12, 2024, 7:42pm UTC](https://forum.ansible.com/t/how-to-use-an-inventory-variable-in-a-lookup-of-aws-secret/7255 "2024-07-12T19:42:44Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![PB70](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pb70/32/4214_2.png) [@PB70](https://forum.ansible.com/u/PB70)\
**Post date:** [July 12, 2024, 7:42pm UTC](https://forum.ansible.com/t/how-to-use-an-inventory-variable-in-a-lookup-of-aws-secret/7255/1 "2024-07-12T19:42:44Z")

</div>

I am trying to lookup an aws\_secret using the lookup functionality, but I want the path to the secret I lookup to come from an inventory variable. That way I can have a different secret for each environment (dev, stage, prod) and lookup the appropriate secret.

for example, have a inventory variable that looks like this:  
`db_password_path=dev/db_password`

and a lookup that looks like:  
`"{{ lookup('amazon.aws.aws_secret', '' + db_password_path ) }}"`

when I run my playbook I get this error:

```auto
objc[21349]: +[__NSCFConstantString initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug.
ERROR! A worker was found in a dead state'''
```

---

<div class="post-metadata">

**Author:** ![jrglynn2](https://avatars.discourse-cdn.com/v4/letter/j/94ad74/32.png) [@jrglynn2](https://forum.ansible.com/u/jrglynn2)\
**Post date:** [July 12, 2024, 7:52pm UTC](https://forum.ansible.com/t/how-to-use-an-inventory-variable-in-a-lookup-of-aws-secret/7255/2 "2024-07-12T19:52:16Z")

</div>

I have never used an AWS Secret with a `/` in the name - to be clear, the name of your AWS Secret is `dev/db_password`?

If so, maybe that variable needs quotes? Maybe it should be:

```auto
db_password_path="dev/db_password"

```

I use a lookup like this that works fine - `ansible_user: "{{ lookup('amazon.aws.aws_secret', 'ansibleTEST.user', region='us-east-1', nested=true) }}"` - where `ansibleTEST` is the name of my AWS Secret document, and `user` is the secret I am looking up.

---

<div class="post-metadata">

**Author:** ![PB70](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pb70/32/4214_2.png) [@PB70](https://forum.ansible.com/u/PB70)\
**Post date:** [July 12, 2024, 8:13pm UTC](https://forum.ansible.com/t/how-to-use-an-inventory-variable-in-a-lookup-of-aws-secret/7255/3 "2024-07-12T20:13:06Z")

</div>

Yes, most of our AWS Secret’s have a / in the name. And that doesn’t appear to be the problem here. I did try putting quotes around the secret name as suggested, same error message.  
If I understand correctly the difference between your example and my use case is that “ansibleTest” is the literal name of your secret. I want db\_password\_path to dereference to the value “dev/db\_password” which is the literal name of my secret. And I am getting a runtime error that is causing the python code to crash.

---

<div class="post-metadata">

**Author:** ![jrglynn2](https://avatars.discourse-cdn.com/v4/letter/j/94ad74/32.png) [@jrglynn2](https://forum.ansible.com/u/jrglynn2)\
**Post date:** [July 12, 2024, 8:41pm UTC](https://forum.ansible.com/t/how-to-use-an-inventory-variable-in-a-lookup-of-aws-secret/7255/4 "2024-07-12T20:41:50Z")

</div>

Yeah, unfortunately I can’t help with the runtime error…

I would try hard-coding the value in, to ensure that the lookup works - at least that will narrow down the issue to the variable.

I have used the same format with a variable:

```auto
aws_secrets_user: "{{ lookup('amazon.aws.aws_secret','{{ aws_secret_name }}.user', region='us-east-1', nested=true) }}"

```

That also works fine for me…

---

<div class="post-metadata">

**Author:** ![PB70](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pb70/32/4214_2.png) [@PB70](https://forum.ansible.com/u/PB70)\
**Post date:** [July 12, 2024, 9:01pm UTC](https://forum.ansible.com/t/how-to-use-an-inventory-variable-in-a-lookup-of-aws-secret/7255/5 "2024-07-12T21:01:31Z")

</div>

Thank you for that snip it of code. That gives me hope that I might be able to get this to work. I did hard code the variable name and I get the same error. So now I’m not sure what is causing it. Will have to keep digging into it.

---

<div class="post-metadata">

**Author:** ![flowerysong](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/flowerysong/32/2305_2.png) [@flowerysong](https://forum.ansible.com/u/flowerysong)\
**Post date:** [July 12, 2024, 10:54pm UTC](https://forum.ansible.com/t/how-to-use-an-inventory-variable-in-a-lookup-of-aws-secret/7255/6 "2024-07-12T22:54:52Z")

</div>

This is a known issue with running Ansible on MacOS, not anything to do with using inventory variables.

[https://docs.ansible.com/ansible/latest/reference\_appendices/faq.html#running-on-macos-as-a-control-node](https://docs.ansible.com/ansible/latest/reference_appendices/faq.html#running-on-macos-as-a-control-node)

---

<div class="post-metadata">

**Author:** ![PB70](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/pb70/32/4214_2.png) [@PB70](https://forum.ansible.com/u/PB70)\
**Post date:** [July 15, 2024, 5:33pm UTC](https://forum.ansible.com/t/how-to-use-an-inventory-variable-in-a-lookup-of-aws-secret/7255/7 "2024-07-15T17:33:05Z")

</div>

Thank you. This post probably saved me a bunch more time trying to figure out the issue. That recommendation did get me past this problem and on to the next one.

---

<div class="post-metadata">

**Author:** ![jrglynn2](https://avatars.discourse-cdn.com/v4/letter/j/94ad74/32.png) [@jrglynn2](https://forum.ansible.com/u/jrglynn2)\
**Post date:** [July 16, 2024, 6:19pm UTC](https://forum.ansible.com/t/how-to-use-an-inventory-variable-in-a-lookup-of-aws-secret/7255/8 "2024-07-16T18:19:21Z")

</div>

Cool glad we could help. To help others using the forum, you can mark this as solved and choose whichever comment resolved the issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [August 15, 2024, 6:19pm UTC](https://forum.ansible.com/t/how-to-use-an-inventory-variable-in-a-lookup-of-aws-secret/7255/9 "2024-08-15T18:19:26Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.