diff --git a/playbooks/roles/edx_service/tasks/main.yml b/playbooks/roles/edx_service/tasks/main.yml
index 93342c296..eeeff9671 100644
--- a/playbooks/roles/edx_service/tasks/main.yml
+++ b/playbooks/roles/edx_service/tasks/main.yml
@@ -93,6 +93,13 @@
     - install
     - install:base
 
+# This can be very hard to debug if it fails, as the `no_log` is required in
+# order to prevent app secrets from being exposed.
+#
+# Known causes to investigate when this task fails:
+#
+# - AWS secrets with malformed JSON (even ones unrelated to the service being
+#   built). Possibly also references in ansible/vars/ to nonexistent AWS secrets.
 - name: Write out app config file
   template:
     src: "config.yml.j2"