Resource type exec, Deferred, and Vault

[Bob Negri]

Is it possible to use Deferred with the command in resource type exec?

The code we are trying to replace to use a Vault secret has an gpg key as a passed in secret. I saw a code example in Ben Ford's blog post.

notify { 'vault server debugging': # Defer interpolation to runtime after the value is resolved. message => Deferred( 'sprintf', ['Password: %s', $db_password] ), }

I was wondering if similar logic could be used for exec? And maybe %p is better for a key than %s.

[Bob Negri]

Answer is, it seems to work with Deferred('sprint', ['Password: %s', $db_password].

There are issues around special characters in the password string, like and exclamation point.