# Sensitive variables in Ansible Galaxy

**URL:** <https://forum.ansible.com/t/sensitive-variables-in-ansible-galaxy/16059>\
**Category:** Ansible Project\
**Tags:** galaxy-ng\
**Created:** [August 28, 2014, 7:49am UTC](https://forum.ansible.com/t/sensitive-variables-in-ansible-galaxy/16059 "2014-08-28T07:49:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jake\_Clarkson](https://avatars.discourse-cdn.com/v4/letter/j/b3f665/32.png) [@Jake\_Clarkson](https://forum.ansible.com/u/Jake_Clarkson)\
**Post date:** [August 28, 2014, 7:49am UTC](https://forum.ansible.com/t/sensitive-variables-in-ansible-galaxy/16059/1 "2014-08-28T07:49:57Z")

</div>

Hi all,

I was just wondering what the best practice is for including sensitive variables in an Ansible Galaxy role.

For example, if I were to publish a role which required sensitive (i.e. vault encrypted) data, e.g. an API key, would I just document that this variable was required in the README.md?

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![Tomasz\_Kontusz](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@Tomasz\_Kontusz](https://forum.ansible.com/u/Tomasz_Kontusz)\
**Post date:** [August 28, 2014, 11:36am UTC](https://forum.ansible.com/t/sensitive-variables-in-ansible-galaxy/16059/2 "2014-08-28T11:36:45Z")

</div>

Jake Clarkson \<jacobwclarkson@gmail.com\> napisał:

> Hi all,
> 
> I was just wondering what the best practice is for including sensitive  
> variables in an Ansible Galaxy role.
> 
> For example, if I were to publish a role which required sensitive (i.e.
> 
> vault encrypted) data, e.g. an API key, would I just document that this
> 
> variable was required in the README.md?

Yes. It's the user that will decide how sensitive that data is to him, and where to store it 🙂

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [August 28, 2014, 11:56am UTC](https://forum.ansible.com/t/sensitive-variables-in-ansible-galaxy/16059/3 "2014-08-28T11:56:21Z")

</div>

Obviously don’t include your AWS key in the defaults or examples, just use dummy values, but it’s up to them.

Folks should be aware of ansible-vault and I don’t think it’s necessary for the galaxy role to remind users to use it, but it’s ok if the role did too.

Definitely doesn’t need to be a list of which variables, etc, as a lot of folks are using private repos and such.