Answers: <p>One way is to get the value twice, with <code>decrypt=false</code> and <code>decrypt=true</code>, and compare them.</p>
  <pre><code>- name: Get the value from AWS Parameter Store
    set_fact:
      var_value_decrypted: &quot;{{ lookup('aws_ssm', var_path, decrypt=true, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}&quot;
      var_value_as_is: &quot;{{ lookup('aws_ssm', var_path, decrypt=false, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}&quot;
  
  - name: Fail since the value is encrypted and permission_to_decrypt is false
    debug: 
      msg:
        - &quot;VALUE:  FAILED_TO_DECRYPT&quot;
    when: var_value_decrypted != var_value_as_is and not permission_to_decrypt | bool
  
  - name: Show the value
    debug: 
      msg:
        - &quot;VALUE:  {{ var_value_decrypted | default( 'KEY_NOT_FOUND' ) }}&quot;
    when: var_value_decrypted == var_value_as_is or permission_to_decrypt | bool
  </code></pre>
  <p>If they are different and <code>permission_to_decrypt</code> is false, fail with an error</p>
  <pre><code>&quot;VALUE:  FAILED_TO_DECRYPT&quot;
  </code></pre>
  <p>If they are the same or <code>permission_to_decrypt</code> is true, show the value</p>
  <pre><code>&quot;VALUE:  super secret string&quot;
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2021-12-23T15:38:57.470Z
Answers: 2021-12-29T14:19:29.877Z
Answers: 2021-12-29T14:19:29.877Z
Answers: AndrewRalon
Body: <p>I need to lookup a value from AWS SSM Parameter Store, but it needs to fail if the parameter type is secure string.</p>
  <p>I do NOT want secure string parameters to be decrypted, and I want to detect their type and fail gracefully.</p>
  <pre><code>  - name: Get the value from AWS Parameter Store
      set_fact:
        var_value: &quot;{{ lookup('aws_ssm', var_path, decrypt=False, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}&quot;
  
  - name: Show the value
    debug: 
      msg:
        - &quot;VALUE:  {{ var_value | default( 'FAILED_TO_DECRYPT' ) }}&quot;
  </code></pre>
  <p>However, the <code>aws_ssm</code> module does not fail when told not to decrypt a secure string. It returns the encrypted string (not helpful). I don't see a way to detect parameter type.</p>
  <pre><code>TASK [Show the value] **********************************************************
  ok: [127.0.0.1] =&gt; {
      &quot;msg&quot;: [
          &quot;VALUE:  CRAZY_LONG_ENCRYPTED_STRING_AND_NOT_THE_REAL_VALUE&quot;
      ]
  }
  </code></pre>
  <p>What is a best practice for intentionally failing to decrypt secure strings?</p>
  <p>References:</p>
  <ol>
  <li><a href="https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ssm_lookup.html" rel="nofollow noreferrer">https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ssm_lookup.html</a></li>
  <li><a href="https://docs.ansible.com/ansible/latest/collections/community/aws/aws_ssm_parameter_store_module.html" rel="nofollow noreferrer">https://docs.ansible.com/ansible/latest/collections/community/aws/aws_ssm_parameter_store_module.html</a></li>
  </ol>
  
Comments: CC BY-SA 4.0
Comments: 2021-12-28T21:20:55.997Z
Comments: As a side note, you should not nest moustaches. `{{ lookup('aws_ssm', '{{ var_path }}') }}` should instead be `{{ lookup('aws_ssm', var_path) }}`. Once you are in a Jinja expression you do not need additional delimiters.
Comments: flowerysong
Comments: CC BY-SA 4.0
Comments: 2021-12-29T13:59:49.077Z
Comments: @flowerysong Thanks!
Comments: AndrewRalon
Tags: <amazon-web-services><ansible><amazon-ssm>
Title: Ansible to get AWS SSM Parameter Store value but fail to decrypt secure strings
UserDisplayName: AndrewRalon
ThreadText: # Ansible to get AWS SSM Parameter Store value but fail to decrypt secure strings
  
  (Asked by: username_0 on 2021-12-23)
  
  I need to lookup a value from AWS SSM Parameter Store, but it needs to fail if the parameter type is secure string.
  
  I do NOT want secure string parameters to be decrypted, and I want to detect their type and fail gracefully.
  
  ```
    - name: Get the value from AWS Parameter Store
      set_fact:
        var_value: "{{ lookup('aws_ssm', var_path, decrypt=False, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"
  
  - name: Show the value
    debug: 
      msg:
        - "VALUE:  {{ var_value | default( 'FAILED_TO_DECRYPT' ) }}"
  
  ```
  
  However, the `aws_ssm` module does not fail when told not to decrypt a secure string. It returns the encrypted string (not helpful). I don't see a way to detect parameter type.
  
  ```
  TASK [Show the value] **********************************************************
  ok: [127.0.0.1] => {
      "msg": [
          "VALUE:  CRAZY_LONG_ENCRYPTED_STRING_AND_NOT_THE_REAL_VALUE"
      ]
  }
  
  ```
  
  What is a best practice for intentionally failing to decrypt secure strings?
  
  References:
  
  1. <https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ssm_lookup.html>
  2. <https://docs.ansible.com/ansible/latest/collections/community/aws/aws_ssm_parameter_store_module.html>
  
  **Tags:** amazon-web-services, ansible, amazon-ssm
  
  > **Comments:**
  > **username_1**: As a side note, you should not nest moustaches. `{{ lookup('aws_ssm', '{{ var_path }}') }}` should instead be `{{ lookup('aws_ssm', var_path) }}`. Once you are in a Jinja expression you do not need additional delimiters.  
  > **username_0**: @username_1 Thanks!  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2021-12-23. Score: 1
  
  One way is to get the value twice, with `decrypt=false` and `decrypt=true`, and compare them.
  
  ```
  - name: Get the value from AWS Parameter Store
    set_fact:
      var_value_decrypted: "{{ lookup('aws_ssm', var_path, decrypt=true, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"
      var_value_as_is: "{{ lookup('aws_ssm', var_path, decrypt=false, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"
  
  - name: Fail since the value is encrypted and permission_to_decrypt is false
    debug: 
      msg:
        - "VALUE:  FAILED_TO_DECRYPT"
    when: var_value_decrypted != var_value_as_is and not permission_to_decrypt | bool
  
  - name: Show the value
    debug: 
      msg:
        - "VALUE:  {{ var_value_decrypted | default( 'KEY_NOT_FOUND' ) }}"
    when: var_value_decrypted == var_value_as_is or permission_to_decrypt | bool
  
  ```
  
  If they are different and `permission_to_decrypt` is false, fail with an error
  
  ```
  "VALUE:  FAILED_TO_DECRYPT"
  
  ```
  
  If they are the same or `permission_to_decrypt` is true, show the value
  
  ```
  "VALUE:  super secret string"
  
  ```
  
  
  ---
  
  