# TSS Lookup and AWX **URL:** \ **Category:** Get Help\ **Tags:** awx, ee\ **Created:** [September 4, 2025, 12:16pm UTC](https://forum.ansible.com/t/tss-lookup-and-awx/44416 "2025-09-04T12:16:48Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [September 4, 2025, 12:16pm UTC](https://forum.ansible.com/t/tss-lookup-and-awx/44416/1 "2025-09-04T12:16:49Z")
I’m following the docs: [community.general.tss lookup – Get secrets from Thycotic Secret Server — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/collections/community/general/tss_lookup.html) and my code is: ```auto --- # tasks file for tw.tss - hosts: localhost connection: local gather_facts: no vars: key: !vault | $ANSIBLE_VAULT;1.1;AES256 uri: https:// secret_password: >- {{ lookup( 'community.general.tss', secretid, base_url=uri, token=key ) | from_json).get('items') | items2dict(key_name='slug', value_name='itemValue'))['password'] }} tasks: - ansible.builtin.debug: msg: the password is {{ secret_password }} ``` I have tried a few variations as the docs showed ```auto secret_password: >- {{ ((lookup( 'community.general.tss', 102, base_url='https://secretserver.domain.com/SecretServer/', token='thycotic_access_token', ) | from_json).get('items') | items2dict(key_name='slug', value_name='itemValue'))['password'] }} ``` the trailing ‘,’ seems incorrect and the leeding ‘((’ that are not closed also seemed incorrect. Initially I had those in the error I receive is ```auto Vault password: ERROR! 'ansible.builtin.debug' is not a valid attribute for a Play The error appears to be in '/runner/project/tss.yml': line 31, column 3, but may be elsewhere in the file depending on the exact syntax problem. The offending line appears to be: - ansible.builtin.debug: ^ here ``` Additionally, I have tried the built in secret server integration but it failed, I believe ssl cert trust, but I cannot specify an EE to run it from to bypass. ---
**Author:** ![derb](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/derb/32/4385_2.png) [@derb](https://forum.ansible.com/u/derb)\ **Post date:** [September 4, 2025, 3:52pm UTC](https://forum.ansible.com/t/tss-lookup-and-awx/44416/2 "2025-09-04T15:52:10Z")
> [@trippinnik](#): > > `ERROR! 'ansible.builtin.debug' is not a valid attribute for a Play` I believe you may just need to add a name to your debug task. I took your secret\_password definition and modified to use username and password on my system and it ran successfully. ```auto --- - name: Retrieve Secrets from Delinea SS hosts: localhost gather_facts: false vars: ss_password: "{{ lookup('ansible.builtin.env', 'SS_PASS') }}" ss_username: "{{ lookup('ansible.builtin.env', 'SS_USER') }}" secret_id: ss_url: 'https:///SecretServer' secret_password: >- {{ ((lookup( 'community.general.tss', secret_id, base_url=ss_url, username=ss_username, password=ss_password ) | from_json).get('items') | items2dict(key_name='slug', value_name='itemValue'))['password'] }} tasks: - name: Debug secret_password ansible.builtin.debug: var: secret_password ``` ![ksnip_20250904-115107](https://us1.discourse-cdn.com/ansible/original/2X/8/821a3f7ca0445741962ceaa0ed5410ddd398d5fd.png) ---
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [September 4, 2025, 5:08pm UTC](https://forum.ansible.com/t/tss-lookup-and-awx/44416/3 "2025-09-04T17:08:19Z")
sadly that was one of the first things I tried and it fails with the same error. ---
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [September 4, 2025, 5:20pm UTC](https://forum.ansible.com/t/tss-lookup-and-awx/44416/4 "2025-09-04T17:20:19Z")
i forgot to turn on update revision on launch .. i have a new error but it’s a dependency so probably will work ---
**Author:** ![anon81884396](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@anon81884396](https://forum.ansible.com/u/anon81884396)\ **Post date:** [September 4, 2025, 5:20pm UTC](https://forum.ansible.com/t/tss-lookup-and-awx/44416/5 "2025-09-04T17:20:43Z")
The error says `The error appears to be in '/runner/project/tss.yml': line 31, column 3,` But when I paste your original YAML file, there are 27 lines. So something is missing inbetween what you are testing and what you’ve pasted. Ansible/YAML care about indentation, and the fact it’s barfing at your ansible.builtin.debug implies to me your indentation is off somewhere, but I can’t see where by what you’ve pasted, but as I’ve said, your paste only has 27 lines vs the error counting 31, so something is getting formatted somewhere. ---
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [September 4, 2025, 6:15pm UTC](https://forum.ansible.com/t/tss-lookup-and-awx/44416/6 "2025-09-04T18:15:38Z")
The problem I see now is that we use ```auto tss init -r {{ role }} -k {{ key }} -u {{ uri }} ``` cli then get the secret but the community plugin doesn’t seem to work with role and key? I’ll probably end up using the cmd we use elsewhere