Issue 1:
ISSUE TYPE

Bug Report

COMPONENT NAME

no_log

ANSIBLE VERSION

2.3

CONFIGURATION

OS / ENVIRONMENT

Centos

SUMMARY

Hello, we are using no_log and mysql module and both items are showing passwords in clear text.

Example:

TASK [mysql_users : Grant all privileges to all schemas for REDACTED] **********
14:04:28 Using module file /usr/lib/python2.7/site-packages/ansible/modules/core/database/mysql/mysql_user.py�
<127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: REDACTED
<127.0.0.1> EXEC /bin/sh -c 'AWS_ACCESS_KEY_ID=REDACTED AWS_SECRET_ACCESS_KEY=REDACTED /usr/bin/python2 && sleep 0'

STEPS TO REPRODUCE

Tasks with mysql module or shell module with no_log: true are showing passwords

EXPECTED RESULTS

when using mysql module or shell with no_log: true all passwords or logs should be hidden.

ACTUAL RESULTS

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

no_log

ANSIBLE VERSION

ansible 2.1.1.0
config file = /etc/ansible/ansible.cfg
configured module search path = Default w/o overrides

CONFIGURATION

Using Ansible Tower

OS / ENVIRONMENT

Ubuntu 14.04.4

SUMMARY

I want to run some commands using the AWS CLI (in my particular case, creating new access keys for a user and encrypting them). I am storing the AWS Access Keys Ansible will use to use the CLI in a Vault file and including them, then passing them to environment variables:

- name: "Create a new access key for IAM User {{user}}"
shell:
cmd: "aws iam create-access-key --user-name {{user}}"
environment:
AWS_ACCESS_KEY_ID: "{{AUTH_AWS_ACCESS_KEY_ID}}"
AWS_SECRET_ACCESS_KEY: "{{AUTH_AWS_SECRET_ACCESS_KEY}}"
register: access_key_output
no_log: true

- name: Parse the output to JSON
set_fact:
access_key: "{{access_key_output.stdout|from_json}}"
no_log: true

- name: Extract access key ID and secret
set_fact:
aws_access_key_id: "{{access_key.AccessKey.AccessKeyId}}"
aws_secret_access_key: "{{access_key.AccessKey.SecretAccessKey}}"
no_log: true

# Now we go on to save the newly-set variables into a template and encrypt it

I can apply no_log: true to the tasks where there is sensitive output, to hide the values. But there is no mechanism to prevent the values of environment variables being output in verbose logs (see the XXXs on the penultimate line):

TASK [common : Create a new access key for IAM User bob] *****
task path: /path/to/playbook/roles/common/tasks/main.yml:90
<10.0.1.143> ESTABLISH SSH CONNECTION FOR USER: ansible
<10.0.1.143> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/tmp/ansible_tower_H6lYAD/cp/ansible-ssh-%h-%p-%r 10.0.1.143 '/bin/sh -c '"'"'( umask 77 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214 `" && echo ansible-tmp-1475680443.15-122804029783214="` echo $HOME/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214 `" ) && sleep 0'"'"''
<10.0.1.143> PUT /tmp/tmpkLWcKJ TO /home/ansible/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214/command
<10.0.1.143> SSH: EXEC sftp -b - -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/tmp/ansible_tower_H6lYAD/cp/ansible-ssh-%h-%p-%r '[10.0.1.143]'
<10.0.1.143> ESTABLISH SSH CONNECTION FOR USER: ansible
<10.0.1.143> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ansible -o ConnectTimeout=10 -o ControlPath=/tmp/ansible_tower_H6lYAD/cp/ansible-ssh-%h-%p-%r -tt 10.0.1.143 '/bin/sh -c '"'"'LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8 LC_MESSAGES=en_US.UTF-8 AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX AWS_ACCESS_KEY_ID=XXXXXXXXXXXXXXXXXXXX /usr/bin/python /home/ansible/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214/command; rm -rf "/home/ansible/.ansible/tmp/ansible-tmp-1475680443.15-122804029783214/" > /dev/null 2>&1 && sleep 0'"'"''
changed: [10.0.1.143] => {"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result"}

Which means that the really sensitive data is still output.

There are ways I can circumvent this, by exporting the environment variables in the command, or by using an Ansible module (where the functionality is supported). But this issue is not specific to AWS CLI, it applies whenever you have sensitive data in environment variables.

I believe that setting no_log: true should suppress the output of all verbose logs as well as the 'standard' output. If you're working in verbose mode, you are already debugging/working on a script, so temporarily commenting out the no_log directives should be simple enough.

Alternatively, am I missing an existing feature?