title: selectively avoid writing sensitive data to the log in ansible (without using nolog)
body: <p>I am using a combination of DSC and Ansible.  With anything less than a trivial resource, PSCredentials is often required, these are split into two lines like this example:</p>
  
  <pre><code>PsDscRunAsCredential_username: '{{ansible_user}}'
  PsDscRunAsCredentual_password: '{{ansible_password}}'
  </code></pre>
  
  <p>To avoid writing sensitive info to the Ansible log (e.g. when run in verbose mode, or if it errors), the suggestion is to use the 'nolog' flag.</p>
  
  <p>Unfortunately, this suppresses all information - so if there is an error, you simply get 'CENSORED' returned.</p>
  
  <p>I'm hoping it is possible to amend win_dsc to be a little smarter about this, and was wondering if anyone could point to a similar example in another module that I could learn/borrow from, assuming this is a common requirement?</p>
  
  <p>I would basically like to avoid logging data if the parameter ends with "_password".</p>