# Suppress print of ENV vars in AWX EE **URL:** \ **Category:** Get Help\ **Tags:** ansible-runner, vmware, awx, ee\ **Created:** [February 18, 2025, 7:36pm UTC](https://forum.ansible.com/t/suppress-print-of-env-vars-in-awx-ee/40343 "2025-02-18T19:36:18Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![kokosnuss](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kokosnuss/32/7625_2.png) [@kokosnuss](https://forum.ansible.com/u/kokosnuss)\ **Post date:** [February 18, 2025, 7:36pm UTC](https://forum.ansible.com/t/suppress-print-of-env-vars-in-awx-ee/40343/1 "2025-02-18T19:36:18Z")
Hi everyone, We use a credential of type VMware vcenter ([10. Credentials — Ansible AWX community documentation](https://ansible.readthedocs.io/projects/awx/en/24.6.1/userguide/credentials.html#vmware-vcenter)) in an AWX job template. The credential information (host, username, password) is transferred to the playbook as ENV variables. However, the started automation-job pod writes these ENV variables to stdout at startup. And since stdout comes from pods to Graylog, sensitive information is leaked. Is there a way to suppress the writing of ENV vars in AWX, EE or ansible-runner? ```auto {"status": "starting", "runner_ident": "10091", "command": ["ssh-agent", "sh", "-c", "trap 'rm -f /runner/artifacts/10091/ssh_key_data' EXIT && ssh-add /runner/artifacts/10091/ssh_key_data && rm -f /runner/artifacts/10091/ssh_key_data && ansible-playbook -u **** -e @/runner/env/tmp_wou1p52 -i /runner/inventory/hosts -e @/runner/env/extravars playbook.yaml"], "env": { [...]"VMWARE_PASSWORD": "password-in-clear-text", }[...]} ``` Thanks! ---
**Author:** ![Andersson007](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/andersson007/32/89_2.png) [@Andersson007](https://forum.ansible.com/u/Andersson007)\ **Post date:** [February 19, 2025, 9:20am UTC](https://forum.ansible.com/t/suppress-print-of-env-vars-in-awx-ee/40343/2 "2025-02-19T09:20:42Z")
@kokosnuss hi, generally if you need to pass some credentials to your playbooks, you could use ansible vault. I’m not a AWX user, but i can see that there’s the [credential feature](https://ansible.readthedocs.io/projects/awx/en/24.6.1/userguide/credentials.html) you could try to use and IIRC there’s an option for vault. Maybe there are other cred types you could use. Please awx folks correct me if i’m wrong ---
**Author:** ![iwt-cmd](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iwt-cmd/32/9120_2.png) [@iwt-cmd](https://forum.ansible.com/u/iwt-cmd)\ **Post date:** [February 24, 2025, 3:01pm UTC](https://forum.ansible.com/t/suppress-print-of-env-vars-in-awx-ee/40343/3 "2025-02-24T15:01:15Z")
Hi kokosnuss, There is a “no\_log” option that can be added to tasks which stops the task output from showing on the AWX console. Not sure if that will suppress the output at startup though. [Logging Ansible output — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/reference_appendices/logging.html) If that doesn’t work, you could do a custom credential and recreate the VMWare credential type but pass in the username/password as extra\_vars rather than ENV. Then add the username and password options when the VMWare modules are called. This is a bit hacky but I’ve had to do something similar when I needed to change something from the default credential types. ![image](https://us1.discourse-cdn.com/ansible/original/2X/c/ca4c9f9000282bcd9d21dabbe53339e6362158f3.png) [12. Custom Credential Types — Automation Controller User Guide v4.5](https://docs.ansible.com/automation-controller/latest/html/userguide/credential_types.html) ---
**Author:** ![kokosnuss](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kokosnuss/32/7625_2.png) [@kokosnuss](https://forum.ansible.com/u/kokosnuss)\ **Post date:** [February 25, 2025, 1:12pm UTC](https://forum.ansible.com/t/suppress-print-of-env-vars-in-awx-ee/40343/4 "2025-02-25T13:12:47Z")
Hi everyone, Thank you for your answers. The no\_log option does not work here because it only applies to the playbook and not to the startup component. I already had the solution of copying the credential, but I think it’s too hacky, because it doesn’t scale and I can’t forbid my internal users to use the default vmware credential. i dug deep and found out that the ansible-runner is the causing component and more or less wrote a fix for it: > > > Ansible-Runner is used within AWX to run ansible-playbooks in transmit and worke…r mode. > Since AWX passes the contents (user + password) of some credential types (e.g. VMware vcenter) to the playbook as environment variables, these environment variables are written to stdout in \`streaming.py\`: > https://github.com/ansible/ansible-runner/blob/devel/src/ansible\_runner/streaming.py#L228 > \`self.\_output.write(json.dumps(printed\_status\_data).encode('utf-8'))\` > > In environments such as Red Hat Openshift where global log forwarding to a log streaming server is enabled for all pods and their stdout, this immediately leads to the logging of sensitive data into log management. > This PR offers the possibility to suppress the logging of all environment variables by ansible-runner via CLI flag (\`--suppress-env-print\`) or environment variable (\`SUPPRESS\_ENV\_PRINT\`). > > Due to the fact that awx uses a hard-coded CLI-call for the ansible-runner, it's important to allow log-suppressipon not only via CLI flag but also via environment variable. Otherwise, it would not be configurable: > https://github.com/ansible/awx/blob/devel/awx/main/tasks/receptor.py#L646 > The suppress option can here be achieved via setting the environmet variable \`SUPPRESS\_ENV\_PRINT=True\` using the pod specification for the ansible-runner. ---
**Author:** ![iwt-cmd](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iwt-cmd/32/9120_2.png) [@iwt-cmd](https://forum.ansible.com/u/iwt-cmd)\ **Post date:** [February 25, 2025, 1:49pm UTC](https://forum.ansible.com/t/suppress-print-of-env-vars-in-awx-ee/40343/5 "2025-02-25T13:49:00Z")
iwt-cmd: You can do this hacky solution to work around the issue kokosnuss: Hold my beer \* submits PR to fix the issue \* ![image](https://us1.discourse-cdn.com/ansible/original/2X/0/0404e3cf651a9969a7c463358765da51f24bf2ff.jpeg)