[security] hcloud_certificate, hcloud_server: define no_log values fo…

…r private_key and ssh_keys parameters (#70) * hcloud_certificate, hcloud_server: define no_log values for private_key and ssh_keys parameters * Add changelog fragment
ansible-collections · Mar 26, 2021 · a05de55 · a05de55
1 parent 9f653cb
commit a05de55
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 2 deletions.
diff --git a/changelogs/fragments/70-no_log_security_fixes.yml b/changelogs/fragments/70-no_log_security_fixes.yml
@@ -0,0 +1,2 @@
+security_fixes:
+- hcloud_certificate - mark the ``private_key`` parameter as ``no_log`` to prevent potential leaking of secret values (https://github.com/ansible-collections/hetzner.hcloud/pull/70).
diff --git a/plugins/modules/hcloud_certificate.py b/plugins/modules/hcloud_certificate.py
@@ -232,7 +232,7 @@ def define_module():
                 id={"type": "int"},
                 name={"type": "str"},
                 certificate={"type": "str"},
-                private_key={"type": "str"},
+                private_key={"type": "str", "no_log": True},
                 labels={"type": "dict"},
                 state={
                     "choices": ["absent", "present"],

diff --git a/plugins/modules/hcloud_server.py b/plugins/modules/hcloud_server.py
@@ -563,7 +563,7 @@ def define_module():
                 location={"type": "str"},
                 datacenter={"type": "str"},
                 user_data={"type": "str"},
-                ssh_keys={"type": "list", "elements": "str"},
+                ssh_keys={"type": "list", "elements": "str", "no_log": False},
                 volumes={"type": "list", "elements": "str"},
                 firewalls={"type": "list", "elements": "str"},
                 labels={"type": "dict"},
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		security_fixes:
		- hcloud_certificate - mark the ``private_key`` parameter as ``no_log`` to prevent potential leaking of secret values (https://github.com/ansible-collections/hetzner.hcloud/pull/70).