credstash – retrieve secrets from Credstash on AWS

From Get docs
< Lookup PluginsAnsible/docs/2.8/plugins/lookup/credstash


credstash – retrieve secrets from Credstash on AWS

New in version 2.0.


Synopsis

Requirements

The below requirements are needed on the local master node that executes this lookup.

  • credstash (python library)

Parameters

Parameter Choices/Defaults Configuration Comments

_terms

list / required

term or list of terms to lookup in the credit store

aws_access_key_id

-

env:AWS_ACCESS_KEY_ID

AWS access key ID

aws_secret_access_key

-

env:AWS_SECRET_ACCESS_KEY

AWS access key

aws_session_token

-

env:AWS_SESSION_TOKEN

AWS session token

profile_name

-

env:AWS_PROFILE

AWS profile to use for authentication

region

-

AWS region

table

- / required

Default:

"credential-store"

name of the credstash table to query

version

-

Credstash version



Examples

- name: first use credstash to store your secrets
  shell: credstash put my-github-password secure123

- name: "Test credstash lookup plugin -- get my github password"
  debug: msg="Credstash lookup! {{ lookup('credstash', 'my-github-password') }}"

- name: "Test credstash lookup plugin -- get my other password from us-west-1"
  debug: msg="Credstash lookup! {{ lookup('credstash', 'my-other-password', region='us-west-1') }}"

- name: "Test credstash lookup plugin -- get the company's github password"
  debug: msg="Credstash lookup! {{ lookup('credstash', 'company-github-password', table='company-passwords') }}"

- name: Example play using the 'context' feature
  hosts: localhost
  vars:
    context:
      app: my_app
      environment: production
  tasks:

  - name: "Test credstash lookup plugin -- get the password with a context passed as a variable"
    debug: msg="{{ lookup('credstash', 'some-password', context=context) }}"

  - name: "Test credstash lookup plugin -- get the password with a context defined here"
    debug: msg="{{ lookup('credstash', 'some-password', context=dict(app='my_app', environment='production')) }}"

Return Values

Common return values are documented here, the following are the fields unique to this lookup:

Key Returned Description

_raw

-

value(s) stored in Credstash





Status

Authors

  • UNKNOWN

Hint

If you notice any issues in this documentation, you can edit this document to improve it.


Hint

Configuration entries for each entry type have a low to high priority order. For example, a variable that is lower in the list will override a variable that is higher up.


© 2012–2018 Michael DeHaan
© 2018–2019 Red Hat, Inc.
Licensed under the GNU General Public License version 3.
https://docs.ansible.com/ansible/2.8/plugins/lookup/credstash.html