How does Ansible handle privilege escalation with become?
Learn how Ansible's become handles privilege escalation with sudo, become_user and become_method, plus -K passwords and least-privilege tips for interviews.
Expected Interview Answer
Ansible handles privilege escalation with the 'become' feature, which lets a task or play switch to another user — typically root — to perform actions requiring elevated rights, using an escalation method like sudo, su, pbrun, or doas under the hood.
You enable it with become: true and control who you become with become_user (default root) and how with become_method (default sudo). It can be set at the play, block, or task level, and passwords are supplied via --ask-become-pass (-K) or the ansible_become_password variable. This keeps you connecting as an unprivileged user while elevating only where needed, following least-privilege practice rather than logging in as root everywhere.
- Run privileged tasks without logging in as root directly
- Fine-grained control at play, block or task level
- Supports sudo, su, doas, pbrun, pfexec and more
- Choose the target user with become_user, not just root
- Follows least-privilege by elevating only where required
AI Mentor Explanation
become is like a fielder temporarily borrowing the captain's authority to reposition the whole field for one over. You connect to the ground as an ordinary player, but when a task needs command-level rights you step up with the captain's armband (become_user), do only what's needed, then hand the authority back — never staying captain the entire match.
Step-by-Step Explanation
Step 1
Enable escalation
Set become: true at play, block, or task level so Ansible elevates privileges for that scope.
Step 2
Choose the target user
Use become_user to define who to switch to; it defaults to root if omitted.
Step 3
Pick the method
Set become_method (sudo by default) to su, doas, pbrun, pfexec and others as your system requires.
Step 4
Supply the password
Provide the escalation password with --ask-become-pass (-K) or the ansible_become_password variable, ideally via Vault.
Step 5
Scope to least privilege
Elevate only the tasks that need it, connecting as an unprivileged user for everything else.
What Interviewer Expects
- Knowing become enables privilege escalation to another user
- Understanding become_user defaults to root
- Knowing become_method defaults to sudo but supports su, doas, pbrun
- Awareness of -K / --ask-become-pass for the escalation password
- Grasping the least-privilege rationale of connecting as a normal user
Common Mistakes
- Confusing the connection user (remote_user) with become_user
- Thinking become always means becoming root only
- Forgetting to provide the become password with -K when sudo needs one
- Storing become passwords in plaintext instead of Ansible Vault
- Assuming become requires sudo when other methods exist
Best Answer (HR Friendly)
“Ansible's 'become' feature lets it temporarily act as an administrator to do tasks that need higher permissions, then step back down. It's like briefly borrowing a manager's key card only when a job requires it, which is safer than always working as the top-level admin.”
Code Example
- name: Install and configure nginx
hosts: web
remote_user: deploy
become: true # elevate for the whole play
become_method: sudo # default; could be su, doas, pbrun
tasks:
- name: Install nginx
ansible.builtin.apt:
name: nginx
state: present
- name: Write config as the app user
ansible.builtin.copy:
src: app.conf
dest: /etc/app/app.conf
become_user: appuser # become a specific non-root user for this task
# Run with: ansible-playbook site.yml -K (prompts for sudo password)Follow-up Questions
- What is the difference between remote_user and become_user?
- How do you securely store the become password?
- Which escalation methods does become_method support?
- How do you elevate privileges for only a single task?
- What flag prompts for the privilege escalation password on the CLI?
MCQ Practice
1. What is the default user that 'become' switches to when become_user is not set?
If become_user is omitted, Ansible escalates to root by default.
2. What is the default become_method in Ansible?
sudo is the default privilege escalation method, though su, doas, pbrun and others are supported.
3. Which flag prompts for the privilege escalation password at runtime?
-K (--ask-become-pass) prompts for the become password; lowercase -k asks for the connection password.
Flash Cards
What does 'become: true' do? — Enables privilege escalation so the task runs as another user, defaulting to root.
What sets which user you escalate to? — become_user (defaults to root if not specified).
What is the default become_method? — sudo — but su, doas, pbrun, pfexec and others are supported.
Which CLI flag asks for the become password? — -K or --ask-become-pass.