It's good policy to use ansible vault to define passwords. However, due to an Ansible bug, to_json will not cause the password to be decrypted: https://github.com/ansible/ansible/issues/24425