'Ansible vault shows decrypted values if playbooks executed with debug mode

I am using ansible vault to encrypt the password, but when I am using debug mode it shows the password as plain text. Consider below code

Generate ansible-vault encrypted password

ansible-vault encrypt_string 'abc123' --name ansible_ssh_pass > inventory/group_vars/all.yml

test.yml

- name: Vault test
  hosts: group_1
  tasks:
    - name: Read Json
      set_fact:
         version_file: "{{ lookup('template','template/test.j2') | to_json }}"
      run_once: true

inventory/hosts

[group_1]
xxx.xxx.com ansible_host=xx.xx.xx.xx ansible_user=root
xxx.xxx.com ansible_host=xx.xx.xx.xx ansible_user=root

template/test.j2

{ "host" : "xxx.xxx.com",
  "username" : "root",
  "password" : "{{ hostvars[groups['group_1'][0]]['ansible_ssh_pass'] }}"  }

Playbook execution

ansible-playbook -i inventory/hosts test.yml --ask-vault-pass -vvv

Output

TASK [Read Json] ******************************************************************************************************************************************
task path: /test/test.yml:5
ok: [xxx.xxx.com] => {
    "ansible_facts": {
        "version_file": "\"{ \\\"host\\\" : \\\"xxx.xxx.com\\\",\\n  \\\"username\\\" : \\\"root\\\",\\n  \\\"password\\\" : \\\"abc123\\n\\\"  }\\n\""
    },
    "changed": false,
    "failed": false
}

Is there any way to avoid this?

ansibleansible-inventoryansible-factsansible-vault


Solution 1:[1]

AFIK ansible vault encript passwords, although it can be visible if you use verbose options... For this you have to add to your playbook the option:

no_log: true

Take a look at this link as they say:

I don't believe Ansible keeps track of what came from the vault. To protect the data you can use no_log: true

Solution 2:[2]

To protect the data you can use no_log: true

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1 Alvaro Niño
Solution 2 Joe Cove

Related Questions