Passing VRO-generated customProperties to VRA deployment securely

[risben2]

Hi All.

I currently have a subscribed workflow that retrieves a variable from a third party-API, that passes that variable back via a generated customProperties field, for application by cloud-init from a ${self.[name]) declaration. Due to the nature of the variable, we require it to not be visible in the list of customProperties, in similar fashion to how secrets are not shown/starred-out. Functionally it's working, we just need to hide it.

Is there a mechanism to either selectively or holistically hide custom properties for generated properties? It can be done for properties defined locally to VRA (Secrets, Project level properties, etc), but not for properties being returned from a third party souce. 

Looking for something like a "visible" flag that's applicable to either the custom properties list, or another pass-back mechanism that avoids having the variable listed in the deployment.

Any advice would be appreciated.

[xian_ · Accepted solution]

If you do not need it later on, you can delete the cloudConfig value using an EBS
vRA8: Delete a VM Custom Property via REST? - VMware Technology Network VMTN

[risben2]

Thanks xian_, this does the job of removing the property, however it is left in the deployment's extensibility logs for anyone interested in doing this. Giving Kudos as it is technically correct to the question.  

[xian_]

What exactly logs the value in your EBS?