<p>One way is to get the value twice, with <code>decrypt=false</code> and <code>decrypt=true</code>, and compare them.</p>
<pre><code>- name: Get the value from AWS Parameter Store
  set_fact:
    var_value_decrypted: &quot;{{ lookup('aws_ssm', var_path, decrypt=true, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}&quot;
    var_value_as_is: &quot;{{ lookup('aws_ssm', var_path, decrypt=false, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}&quot;

- name: Fail since the value is encrypted and permission_to_decrypt is false
  debug: 
    msg:
      - &quot;VALUE:  FAILED_TO_DECRYPT&quot;
  when: var_value_decrypted != var_value_as_is and not permission_to_decrypt | bool

- name: Show the value
  debug: 
    msg:
      - &quot;VALUE:  {{ var_value_decrypted | default( 'KEY_NOT_FOUND' ) }}&quot;
  when: var_value_decrypted == var_value_as_is or permission_to_decrypt | bool
</code></pre>
<p>If they are different and <code>permission_to_decrypt</code> is false, fail with an error</p>
<pre><code>&quot;VALUE:  FAILED_TO_DECRYPT&quot;
</code></pre>
<p>If they are the same or <code>permission_to_decrypt</code> is true, show the value</p>
<pre><code>&quot;VALUE:  super secret string&quot;
</code></pre>

CC BY-SA 4.0
2021-12-23T15:38:57.470Z
2021-12-29T14:19:29.877Z
2021-12-29T14:19:29.877Z
AndrewRalon
<p>I need to lookup a value from AWS SSM Parameter Store, but it needs to fail if the parameter type is secure string.</p>
<p>I do NOT want secure string parameters to be decrypted, and I want to detect their type and fail gracefully.</p>
<pre><code>  - name: Get the value from AWS Parameter Store
    set_fact:
      var_value: &quot;{{ lookup('aws_ssm', var_path, decrypt=False, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}&quot;

- name: Show the value
  debug: 
    msg:
      - &quot;VALUE:  {{ var_value | default( 'FAILED_TO_DECRYPT' ) }}&quot;
</code></pre>
<p>However, the <code>aws_ssm</code> module does not fail when told not to decrypt a secure string. It returns the encrypted string (not helpful). I don't see a way to detect parameter type.</p>
<pre><code>TASK [Show the value] **********************************************************
ok: [127.0.0.1] =&gt; {
    &quot;msg&quot;: [
        &quot;VALUE:  CRAZY_LONG_ENCRYPTED_STRING_AND_NOT_THE_REAL_VALUE&quot;
    ]
}
</code></pre>
<p>What is a best practice for intentionally failing to decrypt secure strings?</p>
<p>References:</p>
<ol>
<li><a href="https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ssm_lookup.html" rel="nofollow noreferrer">https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ssm_lookup.html</a></li>
<li><a href="https://docs.ansible.com/ansible/latest/collections/community/aws/aws_ssm_parameter_store_module.html" rel="nofollow noreferrer">https://docs.ansible.com/ansible/latest/collections/community/aws/aws_ssm_parameter_store_module.html</a></li>
</ol>

CC BY-SA 4.0
2021-12-28T21:20:55.997Z
As a side note, you should not nest moustaches. `{{ lookup('aws_ssm', '{{ var_path }}') }}` should instead be `{{ lookup('aws_ssm', var_path) }}`. Once you are in a Jinja expression you do not need additional delimiters.
flowerysong
CC BY-SA 4.0
2021-12-29T13:59:49.077Z
@flowerysong Thanks!
AndrewRalon
<amazon-web-services><ansible><amazon-ssm>
Ansible to get AWS SSM Parameter Store value but fail to decrypt secure strings
AndrewRalon
# Ansible to get AWS SSM Parameter Store value but fail to decrypt secure strings

(Asked by: username_0 on 2021-12-23)

I need to lookup a value from AWS SSM Parameter Store, but it needs to fail if the parameter type is secure string.
I do NOT want secure string parameters to be decrypted, and I want to detect their type and fail gracefully.
  - name: Get the value from AWS Parameter Store
    set_fact:
      var_value: "{{ lookup('aws_ssm', var_path, decrypt=False, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"

- name: Show the value
  debug: 
    msg:
      - "VALUE:  {{ var_value | default( 'FAILED_TO_DECRYPT' ) }}"

However, the aws_ssm module does not fail when told not to decrypt a secure string. It returns the encrypted string (not helpful). I don't see a way to detect parameter type.
TASK [Show the value] **********************************************************
ok: [127.0.0.1] => {
    "msg": [
        "VALUE:  CRAZY_LONG_ENCRYPTED_STRING_AND_NOT_THE_REAL_VALUE"
    ]
}

What is a best practice for intentionally failing to decrypt secure strings?
References:

https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ssm_lookup.html
https://docs.ansible.com/ansible/latest/collections/community/aws/aws_ssm_parameter_store_module.html

**Tags:** amazon-web-services, ansible, amazon-ssm

> **Comments:**
> **username_1**: As a side note, you should not nest moustaches. `{{ lookup('aws_ssm', '{{ var_path }}') }}` should instead be `{{ lookup('aws_ssm', var_path) }}`. Once you are in a Jinja expression you do not need additional delimiters.  
> **username_0**: @username_1 Thanks!  

---

## 1 answers

### Answer by username_0 on 2021-12-23. Score: 1

One way is to get the value twice, with decrypt=false and decrypt=true, and compare them.
- name: Get the value from AWS Parameter Store
  set_fact:
    var_value_decrypted: "{{ lookup('aws_ssm', var_path, decrypt=true, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"
    var_value_as_is: "{{ lookup('aws_ssm', var_path, decrypt=false, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"

- name: Fail since the value is encrypted and permission_to_decrypt is false
  debug: 
    msg:
      - "VALUE:  FAILED_TO_DECRYPT"
  when: var_value_decrypted != var_value_as_is and not permission_to_decrypt | bool

- name: Show the value
  debug: 
    msg:
      - "VALUE:  {{ var_value_decrypted | default( 'KEY_NOT_FOUND' ) }}"
  when: var_value_decrypted == var_value_as_is or permission_to_decrypt | bool

If they are different and permission_to_decrypt is false, fail with an error
"VALUE:  FAILED_TO_DECRYPT"

If they are the same or permission_to_decrypt is true, show the value
"VALUE:  super secret string"


---

