Ansible to get AWS SSM Parameter Store value but fail to decrypt secure strings

Question

I need to lookup a value from AWS SSM Parameter Store, but it needs to fail if the parameter type is secure string.

I do NOT want secure string parameters to be decrypted, and I want to detect their type and fail gracefully.

  - name: Get the value from AWS Parameter Store
    set_fact:
      var_value: "{{ lookup('aws_ssm', var_path, decrypt=False, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"

- name: Show the value
  debug: 
    msg:
      - "VALUE:  {{ var_value | default( 'FAILED_TO_DECRYPT' ) }}"

However, the aws_ssm module does not fail when told not to decrypt a secure string. It returns the encrypted string (not helpful). I don't see a way to detect parameter type.

TASK [Show the value] **********************************************************
ok: [127.0.0.1] => {
    "msg": [
        "VALUE:  CRAZY_LONG_ENCRYPTED_STRING_AND_NOT_THE_REAL_VALUE"
    ]
}

What is a best practice for intentionally failing to decrypt secure strings?

References:

1. https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ssm_lookup.html
2. https://docs.ansible.com/ansible/latest/collections/community/aws/aws_ssm_parameter_store_module.html

Answer 1

One way is to get the value twice, with decrypt=false and decrypt=true, and compare them.

- name: Get the value from AWS Parameter Store
  set_fact:
    var_value_decrypted: "{{ lookup('aws_ssm', var_path, decrypt=true, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"
    var_value_as_is: "{{ lookup('aws_ssm', var_path, decrypt=false, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"

- name: Fail since the value is encrypted and permission_to_decrypt is false
  debug: 
    msg:
      - "VALUE:  FAILED_TO_DECRYPT"
  when: var_value_decrypted != var_value_as_is and not permission_to_decrypt | bool

- name: Show the value
  debug: 
    msg:
      - "VALUE:  {{ var_value_decrypted | default( 'KEY_NOT_FOUND' ) }}"
  when: var_value_decrypted == var_value_as_is or permission_to_decrypt | bool

If they are different and permission_to_decrypt is false, fail with an error

"VALUE:  FAILED_TO_DECRYPT"

If they are the same or permission_to_decrypt is true, show the value

"VALUE:  super secret string"