Ansible become Example: sudo Privilege Escalation

Q: What Is become in Ansible?

become is how Ansible escalates privileges — run tasks as root or any other user. By default, it uses sudo, but also supports su, pbrun, pfexec, doas, and others. You can set it at play level, task level, or in configuration.

What Is become in Ansible?

become is how Ansible escalates privileges — run tasks as root or any other user. By default, it uses sudo, but also supports su, pbrun, pfexec, doas, and others. You can set it at play level, task level, or in configuration.

Basic Usage

---
# Play level — all tasks run as root
- name: Configure server
  hosts: all
  become: true          # Enable sudo
  tasks:
    - name: Install nginx
      ansible.builtin.apt:
        name: nginx

    - name: Create directory
      ansible.builtin.file:
        path: /opt/myapp
        state: directory

---
# Task level — only specific tasks use sudo
- name: Mixed privileges
  hosts: all
  tasks:
    - name: Check uptime (no sudo needed)
      ansible.builtin.command: uptime

    - name: Install package (needs sudo)
      ansible.builtin.apt:
        name: nginx
      become: true

    - name: Read user file (no sudo)
      ansible.builtin.command: cat ~/.bashrc

become Parameters

Parameter	Default	Description
`become`	`false`	Enable privilege escalation
`become_user`	`root`	User to become
`become_method`	`sudo`	Method: `sudo`, `su`, `doas`, `pbrun`, etc.
`become_flags`	—	Extra flags for the become method

Run as a Specific User

# Run as application user
- name: Deploy as app user
  ansible.builtin.copy:
    src: app.tar.gz
    dest: /opt/myapp/
  become: true
  become_user: appuser

# Run database command as postgres
- name: Create database
  ansible.builtin.command: createdb myapp
  become: true
  become_user: postgres

# Run multiple tasks as a user
- name: Application tasks
  hosts: appservers
  become: true
  become_user: deploy
  tasks:
    - name: Pull code
      ansible.builtin.git:
        repo: https://github.com/myorg/myapp.git
        dest: /opt/myapp

    - name: Install dependencies
      ansible.builtin.pip:
        requirements: /opt/myapp/requirements.txt
        virtualenv: /opt/myapp/venv

become_method

# Use su instead of sudo
- name: Use su
  ansible.builtin.command: whoami
  become: true
  become_method: su

# Use doas (OpenBSD)
- name: Use doas
  ansible.builtin.command: whoami
  become: true
  become_method: doas

# With flags
- name: Sudo with login shell
  ansible.builtin.command: whoami
  become: true
  become_flags: "-i"    # sudo -i (login shell)

For platform & security teams

Standardizing privilege escalation across a team?

A working become example is only the start. Review sudo policy, secret handling, role boundaries, repository structure, and maintainability before scaling automation access.

Fixed-scope review · typically €1,500–€3,000 · prioritized findings and a remediation plan.

Review your automation controls

Configuration

ansible.cfg

[privilege_escalation]
become = true
become_method = sudo
become_user = root
become_ask_pass = false

Command Line

# Enable become
ansible-playbook site.yml --become

# Specify user
ansible-playbook site.yml --become --become-user=deploy

# Prompt for sudo password
ansible-playbook site.yml --become --ask-become-pass

# Short flags
ansible-playbook site.yml -b -K

Inventory Variables

# Per-host
[webservers]
web-01 ansible_become=true ansible_become_user=root
web-02 ansible_become=true ansible_become_method=doas

# Per-group
[webservers:vars]
ansible_become=true
ansible_become_method=sudo

Passwordless sudo

The most common setup — configure sudoers so Ansible doesn't need a password:

# On the remote host, add to /etc/sudoers.d/ansible:
# deploy ALL=(ALL) NOPASSWD: ALL

- name: Configure passwordless sudo
  ansible.builtin.copy:
    content: "{{ ansible_user }} ALL=(ALL) NOPASSWD: ALL\n"
    dest: /etc/sudoers.d/ansible
    validate: "visudo -cf %s"
    mode: "0440"
  become: true

With sudo Password

# Prompt for password
ansible-playbook site.yml -b -K

# Password from variable
ansible-playbook site.yml -b -e "ansible_become_password=MyPassword"

# From vault-encrypted variable
ansible_become_password: "{{ vault_sudo_password }}"

Practical Patterns

Switch Between Users in One Play

---
- name: Multi-user deployment
  hosts: appservers
  tasks:
    # As root — install packages
    - name: Install dependencies
      ansible.builtin.apt:
        name: [python3, python3-venv, nginx]
      become: true

    # As appuser — deploy code
    - name: Deploy application
      ansible.builtin.git:
        repo: https://github.com/myorg/myapp.git
        dest: /opt/myapp
      become: true
      become_user: appuser

    # As appuser — install Python deps
    - name: Install Python packages
      ansible.builtin.pip:
        requirements: /opt/myapp/requirements.txt
        virtualenv: /opt/myapp/venv
      become: true
      become_user: appuser

    # As root — configure systemd
    - name: Deploy service file
      ansible.builtin.template:
        src: myapp.service.j2
        dest: /etc/systemd/system/myapp.service
      become: true
      notify: Restart myapp

  handlers:
    - name: Restart myapp
      ansible.builtin.service:
        name: myapp
        state: restarted
      become: true

Block with become

# Apply become to a group of tasks
- name: Root tasks
  become: true
  block:
    - ansible.builtin.apt:
        name: nginx
    - ansible.builtin.service:
        name: nginx
        state: started
    - ansible.builtin.file:
        path: /opt/app
        state: directory

- name: User tasks (no become)
  block:
    - ansible.builtin.command: whoami
    - ansible.builtin.debug:
        msg: "Running as {{ ansible_user }}"

Troubleshooting

"Missing sudo password"

# Option 1: Use -K to prompt
ansible-playbook site.yml -b -K

# Option 2: Configure NOPASSWD in sudoers
echo "deploy ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/deploy

# Option 3: Set password in inventory (vault-encrypted)
ansible_become_password: "{{ vault_sudo_pass }}"

"sudo: a password is required" but NOPASSWD is set

Check sudoers file syntax and permissions:

# Must be mode 0440
chmod 440 /etc/sudoers.d/ansible

# Validate syntax
visudo -cf /etc/sudoers.d/ansible

# Check for conflicts — files are processed in order
ls -la /etc/sudoers.d/

"Failed to set permissions on the temporary files"

When becoming an unprivileged user, Ansible needs to set permissions on temp files:

# ansible.cfg
[defaults]
allow_world_readable_tmpfiles = true
# Or better:
pipelining = true

become_user Doesn't Have a Shell

# Service accounts often have /usr/sbin/nologin
# Use become_flags to work around it
- name: Run as service user
  ansible.builtin.command: /opt/app/bin/check
  become: true
  become_user: appuser
  become_flags: "-H -S"  # Preserve HOME, run shell

Conclusion

become handles privilege escalation in Ansible. Set it at play level for plays that need root throughout, or at task level for granular control. The recommended setup: configure passwordless sudo for the Ansible user with a validated sudoers file. Use become_user to run tasks as application users (postgres, appuser, deploy). Use become_method for non-sudo systems (su, doas). Always validate sudoers changes with visudo to avoid locking yourself out.