# plugin with side effects vs module

**URL:** <https://forum.ansible.com/t/plugin-with-side-effects-vs-module/30651>\
**Category:** Ansible Project\
**Created:** [June 25, 2019, 6:41pm UTC](https://forum.ansible.com/t/plugin-with-side-effects-vs-module/30651 "2019-06-25T18:41:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rjwagner.dba](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@rjwagner.dba](https://forum.ansible.com/u/rjwagner.dba)\
**Post date:** [June 25, 2019, 6:41pm UTC](https://forum.ansible.com/t/plugin-with-side-effects-vs-module/30651/1 "2019-06-25T18:41:59Z")

</div>

Hey all - looking for some advice. I need to write either a plugin or a module to interact with Thycotic Secret Server. In most cases, my code will simply retrieve a credential from Thycotic, so a lookup plugin makes perfect sense. However, there are cases where a specific credential doesn’t yet exist in Thycotic, so my code will tell Thycotic to generate a credential, store it in Thycotic, and then return it. The rub here is then we have a side effect; if a credential doesn’t exist, it gets created, stored, and returned. Generally speaking, I tend to view lookup plugins as being read only, so the idea that a lookup plugin would WRITE data is counterintuitive (to me). However, I see the passwordstore plugin also has side effects, so perhaps this isn’t so bad. But I could also write a module (delegated to the control machine) to accomplish the functionality I need, and modules certainly can have side effects. Any opinions from the Core community on which way I should lean? Are lookup plugin side effects really that bad, or am I overreacting?

Appreciate your thoughts. Thanks.

Rob

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [July 5, 2019, 1:52pm UTC](https://forum.ansible.com/t/plugin-with-side-effects-vs-module/30651/2 "2019-07-05T13:52:31Z")

</div>

Personally i would use a module if there is the possibility of a side  
effect, it is 'surprising' to a user to get one in a lookup.

---

<div class="post-metadata">

**Author:** ![rjwagner.dba](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@rjwagner.dba](https://forum.ansible.com/u/rjwagner.dba)\
**Post date:** [July 5, 2019, 1:54pm UTC](https://forum.ansible.com/t/plugin-with-side-effects-vs-module/30651/3 "2019-07-05T13:54:02Z")

</div>

Any thoughts on this? I’ve been mulling it over and (not to dump on passwordstore) it really seems like a lookup plugin shouldn’t have side effects.

Rob