To not reveal sensitive Data like Passwords, * either wrap the rendered Template in `manifests/service.pp`, like ```puppet file { '/etc/logstash/startup.options': content => Sensitive(template('logstash/startup.options.erb')), } ``` * or use EPP instead of ERB, as EPP does handle sensitive Data natively