diff --git a/manifests/storage/s3.pp b/manifests/storage/s3.pp
index 9301de42..0b55b763 100644
--- a/manifests/storage/s3.pp
+++ b/manifests/storage/s3.pp
@@ -39,7 +39,7 @@ class gnocchi::storage::s3(
     'storage/driver':                value => 's3';
     'storage/s3_endpoint_url':       value => $s3_endpoint_url;
     'storage/s3_region_name':        value => $s3_region_name;
-    'storage/s3_access_key_id':      value => $s3_access_key_id;
+    'storage/s3_access_key_id':      value => $s3_access_key_id, secret => true;
     'storage/s3_secret_access_key':  value => $s3_secret_access_key, secret => true;
     'storage/s3_bucket_prefix':      value => $s3_bucket_prefix;
   }
diff --git a/spec/classes/gnocchi_storage_s3_spec.rb b/spec/classes/gnocchi_storage_s3_spec.rb
index ad505040..858dd0ea 100644
--- a/spec/classes/gnocchi_storage_s3_spec.rb
+++ b/spec/classes/gnocchi_storage_s3_spec.rb
@@ -21,7 +21,7 @@ describe 'gnocchi::storage::s3' do
         is_expected.to contain_gnocchi_config('storage/driver').with_value('s3')
         is_expected.to contain_gnocchi_config('storage/s3_endpoint_url').with_value('https://s3-eu-west-1.amazonaws.com')
         is_expected.to contain_gnocchi_config('storage/s3_region_name').with_value('eu-west-1')
-        is_expected.to contain_gnocchi_config('storage/s3_access_key_id').with_value('xyz')
+        is_expected.to contain_gnocchi_config('storage/s3_access_key_id').with_value('xyz').with_secret(true)
         is_expected.to contain_gnocchi_config('storage/s3_secret_access_key').with_value('secret-xyz').with_secret(true)
       end
     end