diff --git a/manifests/backend/s3.pp b/manifests/backend/s3.pp
index 961d0942..c167adbd 100644
--- a/manifests/backend/s3.pp
+++ b/manifests/backend/s3.pp
@@ -79,8 +79,8 @@ class glance::backend::s3(
   }
 
   glance_api_config {
-    'glance_store/s3_store_access_key':              value => $access_key;
-    'glance_store/s3_store_secret_key':              value => $secret_key;
+    'glance_store/s3_store_access_key':              value => $access_key, secret => true;
+    'glance_store/s3_store_secret_key':              value => $secret_key, secret => true;
     'glance_store/s3_store_host':                    value => $host;
     'glance_store/s3_store_bucket':                  value => $bucket;
     'glance_store/s3_store_bucket_url_format':       value => $bucket_url_format;
diff --git a/spec/classes/glance_backend_s3_spec.rb b/spec/classes/glance_backend_s3_spec.rb
index 5212742d..fe6a7078 100644
--- a/spec/classes/glance_backend_s3_spec.rb
+++ b/spec/classes/glance_backend_s3_spec.rb
@@ -15,8 +15,8 @@ describe 'glance::backend::s3' do
 
       it 'configures glance-api.conf' do
         is_expected.to contain_glance_api_config('glance_store/default_store').with_value('s3')
-        is_expected.to contain_glance_api_config('glance_store/s3_store_access_key').with_value('access')
-        is_expected.to contain_glance_api_config('glance_store/s3_store_secret_key').with_value('secret')
+        is_expected.to contain_glance_api_config('glance_store/s3_store_access_key').with_value('access').with_secret(true)
+        is_expected.to contain_glance_api_config('glance_store/s3_store_secret_key').with_value('secret').with_secret(true)
         is_expected.to contain_glance_api_config('glance_store/s3_store_host').with_value('host')
         is_expected.to contain_glance_api_config('glance_store/s3_store_bucket').with_value('bucket')
         is_expected.to contain_glance_api_config('glance_store/s3_store_bucket_url_format').with_value('<SERVICE DEFAULT>')
@@ -45,8 +45,8 @@ describe 'glance::backend::s3' do
       end
 
       it 'configures glance-api.conf' do
-        is_expected.to contain_glance_api_config('glance_store/s3_store_access_key').with_value('access2')
-        is_expected.to contain_glance_api_config('glance_store/s3_store_secret_key').with_value('secret2')
+        is_expected.to contain_glance_api_config('glance_store/s3_store_access_key').with_value('access2').with_secret(true)
+        is_expected.to contain_glance_api_config('glance_store/s3_store_secret_key').with_value('secret2').with_secret(true)
         is_expected.to contain_glance_api_config('glance_store/s3_store_host').with_value('host2')
         is_expected.to contain_glance_api_config('glance_store/s3_store_bucket').with_value('bucket2')
         is_expected.to contain_glance_api_config('glance_store/s3_store_bucket_url_format').with_value('path')