0

I am familiar with the solution of ansible-vault feature.

Our passwords are stored as a call to an external lookup (to be specific - Cyberark password).

However, a regular user can still with simple debug command to see them

ansible -m debug -a var=ansible_password <some host>

I am familiar with ansible feature known as "no_log". When you set this attribute on a task, or on a specific variable (in Ansible argument spec) - the output is hidden, even with high verbosity

Is there a way to set this attribute on ansible_password variable? so no one can print it?

The only other solution we came up with is to use vault, but all the cyberarcpassword lookup came up in order to "cut of" the vault feature...

Idan Tank
  • 27
  • 5

1 Answers1

0

You can set the password to expire or change in Cyberark after each call or execution. Why to worry about user seeing Cyberark's password? It may be useless after Ansible using it.

guistela
  • 104
  • 4