Sensitive data exposure in Ansible default logging settings

Description

When Ansible task inputs or results contain passwords, tokens or keys, those values can appear in execution output or collected logs. Setting no_log=True in [defaults] provides a default that restricts the display and logging of task details. Its omission alone does not establish that data has actually leaked.

Logs may be shared among operators or forwarded to external systems. Sensitive values in them can become visible to users who otherwise cannot access the credentials.

Potential impact

Passwords, tokens and keys can remain in shared execution output or logs.
Retained logs can continue to expose credentials after an incident.

Remediation

Apply no_log: true to tasks that handle sensitive values. Consider [defaults] no_log=True for a global default, accounting for the loss of output needed for troubleshooting.
no_log does not protect debugging output. Do not write secrets to separate debugging output or application logs.
Review access and retention policies for CI and log stores, and replace credentials that have already been exposed.

Examples

These excerpts compare defaults in ansible.cfg. Check support for the other options against the installed Ansible version.

Before

text

[defaults]
action_warnings=True
allow_unsafe_lookups=False
ask_pass=False
ask_vault_pass=False
debug=False
forks=5
gathering=implicit

No global no_log default is specified. Actual exposure also depends on task-level settings and output content.

After