Sensitive information exposed in Ansible logs

Description

Ansible tasks that handle passwords, tokens or keys need protection against recording sensitive inputs and results in console output and collected logs. no_log: true suppresses task-detail output. Actual exposure also depends on the module’s own masking and separate output paths.

If account creation, password changes or secret deployment output these values, users with log access may see information they were not otherwise permitted to access.

Potential impact

Passwords or tokens can be exposed through CI and operational logs.
Retained logs can continue to expose sensitive information after an incident.

Remediation

Apply no_log: true to tasks handling sensitive values, and verify that actual execution output contains no secrets.
no_log does not protect debugging output. Do not write secrets through debug tasks or separate application logs.
Review existing log stores for exposure and excessive access, and replace credentials that have leaked.

Examples

Supply app_password securely in the password format required by the user module for the target operating system. These excerpts compare task output controls; they do not secure password storage or delivery.

Before

yaml

---
- name: 사용자 생성
  hosts: localhost
  tasks:
    - name: 애플리케이션 계정 생성
      ansible.builtin.user:
        name: app_user
        password: "{{ app_password }}"
      no_log: false

Task-wide output suppression is disabled. Even if the module masks some secret fields, check other output for sensitive values.

After