diff --git a/manifests/storage/s3.pp b/manifests/storage/s3.pp
index f87af859..d0505cbb 100644
--- a/manifests/storage/s3.pp
+++ b/manifests/storage/s3.pp
@@ -40,7 +40,7 @@ class gnocchi::storage::s3(
     'storage/s3_endpoint_url':       value => $s3_endpoint_url;
     'storage/s3_region_name':        value => $s3_region_name;
     'storage/s3_access_key_id':      value => $s3_access_key_id;
-    'storage/s3_secret_access_key':  value => $s3_secret_access_key;
+    'storage/s3_secret_access_key':  value => $s3_secret_access_key, secret => true;
     'storage/s3_bucket_prefix':      value => $s3_bucket_prefix;
   }
 
diff --git a/spec/classes/gnocchi_storage_s3_spec.rb b/spec/classes/gnocchi_storage_s3_spec.rb
index 69da2730..ad505040 100644
--- a/spec/classes/gnocchi_storage_s3_spec.rb
+++ b/spec/classes/gnocchi_storage_s3_spec.rb
@@ -22,7 +22,7 @@ describe 'gnocchi::storage::s3' do
         is_expected.to contain_gnocchi_config('storage/s3_endpoint_url').with_value('https://s3-eu-west-1.amazonaws.com')
         is_expected.to contain_gnocchi_config('storage/s3_region_name').with_value('eu-west-1')
         is_expected.to contain_gnocchi_config('storage/s3_access_key_id').with_value('xyz')
-        is_expected.to contain_gnocchi_config('storage/s3_secret_access_key').with_value('secret-xyz')
+        is_expected.to contain_gnocchi_config('storage/s3_secret_access_key').with_value('secret-xyz').with_secret(true)
       end
     end
   end