<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">no_log</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<p dir="auto">2.3</p>
<h5 dir="auto">CONFIGURATION</h5>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">Centos</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">Hello, we are using no_log and mysql module and both items are showing passwords in clear text.</p>
<p dir="auto">Example:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="TASK [mysql_users : Grant all privileges to all schemas for REDACTED] ********** 
14:04:28 Using module file /usr/lib/python2.7/site-packages/ansible/modules/core/database/mysql/mysql_user.py�
&lt;127.0.0.1&gt; ESTABLISH LOCAL CONNECTION FOR USER: REDACTED
&lt;127.0.0.1&gt; EXEC /bin/sh -c 'AWS_ACCESS_KEY_ID=REDACTED AWS_SECRET_ACCESS_KEY=REDACTED /usr/bin/python2 &amp;&amp; sleep 0'"><pre class="notranslate"><code class="notranslate">TASK [mysql_users : Grant all privileges to all schemas for REDACTED] ********** 
14:04:28 Using module file /usr/lib/python2.7/site-packages/ansible/modules/core/database/mysql/mysql_user.py�
&lt;127.0.0.1&gt; ESTABLISH LOCAL CONNECTION FOR USER: REDACTED
&lt;127.0.0.1&gt; EXEC /bin/sh -c 'AWS_ACCESS_KEY_ID=REDACTED AWS_SECRET_ACCESS_KEY=REDACTED /usr/bin/python2 &amp;&amp; sleep 0'
</code></pre></div>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">Tasks with mysql module or shell module with no_log: true are showing passwords</p>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">when using mysql module or shell with no_log: true all passwords or logs should be hidden.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content=""><pre class="notranslate"><code class="notranslate"></code></pre></div>
<h5 dir="auto">ISSUE TYPE</h5>

<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>

<p dir="auto">no_log</p>
<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.1.1.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides"><pre class="notranslate"><code class="notranslate">ansible 2.1.1.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>

<p dir="auto">Using Ansible Tower</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>

<p dir="auto">Ubuntu 14.04.4</p>
<h5 dir="auto">SUMMARY</h5>

<p dir="auto">I want to run some commands using the AWS CLI (in my particular case, creating new access keys for a user and encrypting them).  I am storing the AWS Access Keys Ansible will use to use the CLI in a Vault file and including them, then passing them to environment variables:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="  - name: &quot;Create a new access key for IAM User {{user}}&quot;
    shell:
        cmd: &quot;aws iam create-access-key --user-name {{user}}&quot;
    environment:
        AWS_ACCESS_KEY_ID: &quot;{{AUTH_AWS_ACCESS_KEY_ID}}&quot;
        AWS_SECRET_ACCESS_KEY: &quot;{{AUTH_AWS_SECRET_ACCESS_KEY}}&quot;
    register: access_key_output
    no_log: true

  - name: Parse the output to JSON
    set_fact:
        access_key: &quot;{{access_key_output.stdout|from_json}}&quot;
    no_log: true

  - name: Extract access key ID and secret
    set_fact:
        aws_access_key_id: &quot;{{access_key.AccessKey.AccessKeyId}}&quot;
        aws_secret_access_key: &quot;{{access_key.AccessKey.SecretAccessKey}}&quot;
    no_log: true

    # Now we go on to save the newly-set variables into a template and encrypt it"><pre class="notranslate"><code class="notranslate">  - name: "Create a new access key for IAM User {{user}}"
    shell:
        cmd: "aws iam create-access-key --user-name {{user}}"
    environment:
        AWS_ACCESS_KEY_ID: "{{AUTH_AWS_ACCESS_KEY_ID}}"
        AWS_SECRET_ACCESS_KEY: "{{AUTH_AWS_SECRET_ACCESS_KEY}}"
    register: access_key_output
    no_log: true

  - name: Parse the output to JSON
    set_fact:
        access_key: "{{access_key_output.stdout|from_json}}"
    no_log: true

  - name: Extract access key ID and secret
    set_fact:
        aws_access_key_id: "{{access_key.AccessKey.AccessKeyId}}"
        aws_secret_access_key: "{{access_key.AccessKey.SecretAccessKey}}"
    no_log: true

    # Now we go on to save the newly-set variables into a template and encrypt it
</code></pre></div>
<p dir="auto">I can apply <code class="notranslate">no_log: true</code> to the tasks where there is sensitive output, to hide the values.  But there is no mechanism to prevent the values of environment variables being output in verbose logs (see the XXXs on the penultimate line):</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="TASK [common : Create a new access key for IAM User bob] *****
task path: /path/to/playbook/roles/common/tasks/main.yml:90
&lt;10.0.1.143&gt; ESTABLISH SSH CONNECTION FOR USER: ansible
&lt;10.0.1.143&gt; SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/tmp/ansible_tower_H6lYAD/cp/ansible-ssh-%h-%p-%r 10.0.1.143 '/bin/sh -c '&quot;'&quot;'( umask 77 &amp;&amp; mkdir -p &quot;` echo $HOME/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214 `&quot; &amp;&amp; echo ansible-tmp-1475680443.15-122804029783214=&quot;` echo $HOME/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214 `&quot; ) &amp;&amp; sleep 0'&quot;'&quot;''
&lt;10.0.1.143&gt; PUT /tmp/tmpkLWcKJ TO /home/ansible/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214/command
&lt;10.0.1.143&gt; SSH: EXEC sftp -b - -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/tmp/ansible_tower_H6lYAD/cp/ansible-ssh-%h-%p-%r '[10.0.1.143]'
&lt;10.0.1.143&gt; ESTABLISH SSH CONNECTION FOR USER: ansible
&lt;10.0.1.143&gt; SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/tmp/ansible_tower_H6lYAD/cp/ansible-ssh-%h-%p-%r -tt 10.0.1.143 '/bin/sh -c '&quot;'&quot;'LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 LC_MESSAGES=en_US.UTF-8 AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX AWS_ACCESS_KEY_ID=XXXXXXXXXXXXXXXXXXXX /usr/bin/python /home/ansible/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214/command; rm -rf &quot;/home/ansible/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214/&quot; &gt; /dev/null 2&gt;&amp;1 &amp;&amp; sleep 0'&quot;'&quot;''
changed: [10.0.1.143] =&gt; {&quot;censored&quot;: &quot;the output has been hidden due to the fact that 'no_log: true' was specified for this result&quot;}"><pre class="notranslate"><code class="notranslate">TASK [common : Create a new access key for IAM User bob] *****
task path: /path/to/playbook/roles/common/tasks/main.yml:90
&lt;10.0.1.143&gt; ESTABLISH SSH CONNECTION FOR USER: ansible
&lt;10.0.1.143&gt; SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/tmp/ansible_tower_H6lYAD/cp/ansible-ssh-%h-%p-%r 10.0.1.143 '/bin/sh -c '"'"'( umask 77 &amp;&amp; mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214 `" &amp;&amp; echo ansible-tmp-1475680443.15-122804029783214="` echo $HOME/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214 `" ) &amp;&amp; sleep 0'"'"''
&lt;10.0.1.143&gt; PUT /tmp/tmpkLWcKJ TO /home/ansible/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214/command
&lt;10.0.1.143&gt; SSH: EXEC sftp -b - -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/tmp/ansible_tower_H6lYAD/cp/ansible-ssh-%h-%p-%r '[10.0.1.143]'
&lt;10.0.1.143&gt; ESTABLISH SSH CONNECTION FOR USER: ansible
&lt;10.0.1.143&gt; SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/tmp/ansible_tower_H6lYAD/cp/ansible-ssh-%h-%p-%r -tt 10.0.1.143 '/bin/sh -c '"'"'LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 LC_MESSAGES=en_US.UTF-8 AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX AWS_ACCESS_KEY_ID=XXXXXXXXXXXXXXXXXXXX /usr/bin/python /home/ansible/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214/command; rm -rf "/home/ansible/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214/" &gt; /dev/null 2&gt;&amp;1 &amp;&amp; sleep 0'"'"''
changed: [10.0.1.143] =&gt; {"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result"}
</code></pre></div>
<p dir="auto">Which means that the <em>really</em> sensitive data is still output.</p>
<p dir="auto">There are ways I can circumvent this, by exporting the environment variables in the command, or by using an Ansible module (where the functionality is supported).  But this issue is not specific to AWS CLI, it applies whenever you have sensitive data in environment variables.</p>
<p dir="auto">I believe that setting <code class="notranslate">no_log: true</code> should suppress the output of all verbose logs as well as the 'standard' output.  If you're working in verbose mode, you are already debugging/working on a script, so temporarily commenting out the <code class="notranslate">no_log</code> directives should be simple enough.</p>
<p dir="auto">Alternatively, am I missing an existing feature?</p>