# Question regarding no\_log = true

**URL:** <https://forum.ansible.com/t/question-regarding-no-log-true/38540>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [October 23, 2023, 6:41am UTC](https://forum.ansible.com/t/question-regarding-no-log-true/38540 "2023-10-23T06:41:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![thirumalairaja](https://avatars.discourse-cdn.com/v4/letter/t/c6cbf5/32.png) [@thirumalairaja](https://forum.ansible.com/u/thirumalairaja)\
**Post date:** [October 23, 2023, 6:41am UTC](https://forum.ansible.com/t/question-regarding-no-log-true/38540/1 "2023-10-23T06:41:48Z")

</div>

Hi all,

below is my task to run terraform code and vinyl entry for newly created VM on the vsphere Vcenter i have pass my credentials in ansible vault “secrets.yaml” my question is that when i run the playbook in the log i my credentials are visible when i use no\_log = true i cant see the log if any error anyone can help me on that how to handle.

> > name: Building Windows VM |
> 
> - | - |
> 
> > hosts: localhost |  
> > vars: |  
> > domain: “[xyz.test.com](http://xyz.test.com)” |  
> > vars\_files: |
> > 
> > - variables/vm\_data.yaml |
> > - secrets.yaml |
> > 
> > > 
> > 
> > tasks: |

| 
- name: Build\_VM

 |
| | 

shell: |

 |
| | 

cd terraform\_config\_files/Windows

 |
| | 

terraform apply -var ‘vsphere\_username={{vsphere\_username}}’ -var ‘vsphere\_password={{vsphere\_password}}’ -var ‘domain\_admin\_username={{domain\_admin\_username}}’ -var ‘domain\_admin\_password={{domain\_admin\_password}}’ -var ‘vm\_admin\_password={{vm\_admin\_password}}’ -auto-approve

 |
| | 

register: output

 |
| | 
# no\_log: true
 |
| | 

tags:

 |
| | 
- terraform apply

 |
| | |
| | 
- name: Vinyl entry

 |
| | 

shell: vinylcli create-record-set --access-key {{access\_key}} --secret-key {{secret\_key}} --record-set-name {{vm\_name}} --record-set-ip {{vm\_ipv4\_address}} --domain {{domain}} --ipcontrol-username {{ipcontrol\_username}} --ipcontrol-password ‘{{ipcontrol\_password}}’

 |
| | 
# no\_log: true
 |
| | 

tags:

 |
| | 
- vinyl\_entry

 |

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [October 23, 2023, 2:33pm UTC](https://forum.ansible.com/t/question-regarding-no-log-true/38540/2 "2023-10-23T14:33:03Z")

</div>

Sadly with `shell` it is an “all or nothing” chioce. If there were a specific vinyl action that could flag the specific fields as `no_log`.

Also, in general, passing secrets in the command line is not very secure, as any user on that system that can inspect the process list and arguments can see it.

Environment variables are slightly better, but I don’t know enough about vinyl to give you alternatives.