ansible.builtin.mask_secrets filter – Redact registered secrets from a string

Note

This filter plugin is part of ansible-core and included in all Ansible installations. In most cases, you can use the short plugin name mask_secrets. However, we recommend you use the Fully Qualified Collection Name (FQCN) ansible.builtin.mask_secrets for easy linking to the plugin documentation and to avoid conflicting with other collections that may have the same filter plugin name.

New in ansible-core 2.22

Synopsis

  • Returns a copy of the input string with every registered secret it contains replaced by a placeholder.

  • Only values previously registered with the secret masker (for example via the ansible.builtin.register_secret filter) are redacted; other text is returned unchanged.

Input

This describes the input of the filter, the value before | ansible.builtin.mask_secrets.

Parameter

Comments

Input

string / required

The string to redact registered secrets from.

Keyword parameters

This describes keyword parameters of the filter. These are the values key1=value1, key2=value2 and so on in the following example: input | ansible.builtin.mask_secrets(key1=value1, key2=value2, ...)

Parameter

Comments

mask_placeholder

string

The text to substitute in place of each registered secret.

Default: "$REDACTED$"

See Also

See also

ansible.builtin.register_secret filter plugin

Register a value as a secret so it is masked in output.

Examples

# Redact any registered secret that appears in a string.
safe_line: "{{ ('token=' ~ api_token) | mask_secrets }}"

# Redact using a custom placeholder.
safe_line: "{{ some_text | mask_secrets(mask_placeholder='***') }}"

Return Value

Key

Description

Return value

string

The input string with any registered secrets replaced by the placeholder.

Returned: success

Authors

  • Ansible Core Team