<p>I'd say to do it as you last explained it: using the admin user created by tf with ansible, and then create any other user using ansible.</p>

<p>The downside is from the security pov, does ansible needs an admin user ? If yes then keep the tf created user, if not then i'd suggest creating a new non-admin user for ansible.</p>

<p>As ansible is a ssh based config mgmt tool, you should think about using a strong pki.</p>

<p>Using the std tf admin user may results in a unique admin created on your every ubuntu vm, with the very same ssh key and this is not a very good practice (although it is a widely spread practice from my personal experience), this is where a real and strong pki may help you.</p>

<p>Anyway, tf needs to create an (admin) user so keep it that way, then switch to you config mgmt to handle any other required users.</p>

CC BY-SA 4.0
2019-07-21T07:13:01.943Z
2019-07-21T07:19:40.110Z
2019-07-21T07:19:40.110Z
Pier
<p><strong>At the controller</strong>, for practical reasons, it's good to create a special user who will be running commands ansible-* as <em>ansible_user</em>. Typically <em>ansible_user</em> connects via ssh to remote hosts and authenticates with the public key.</p>

<ul>
<li><p>It's practical to have different ssh keys for <em>admin</em> and <em>ansible_user</em>.</p></li>
<li><p><em>ansible_user</em> public key will be authorized by all remote hosts.</p></li>
<li><p>Some remote hosts might need the authorization to connect to the controller e.g. ansible-pull</p></li>
<li><p>Typically, Ansible requires /bin/sh to be <em>ansible_user</em> login shell at the remote host.</p></li>
</ul>

<p>There might be more(or less) reasons depending on the scenario.</p>

<p><strong>At the remote host</strong> the admin created by default might be fine with changed credentials and login-shell changed to /bin/sh. But for security reasons creating ansible_user and deleting the default admin should be preferred.</p>

<p>It's good to understand <a href="https://docs.ansible.com/ansible/latest/user_guide/become.html#understanding-privilege-escalation" rel="nofollow noreferrer">Privilege Excalation</a> and the difference of <a href="https://stackoverflow.com/questions/36668756/ansible-remote-user-vs-ansible-user">Ansible remote_user vs ansible_user</a>.</p>

CC BY-SA 4.0
2019-07-21T08:00:29.110Z
2019-07-21T10:30:00.733Z
2019-07-21T10:30:00.733Z
Vladimir Botka
<p>I am creating some Ubuntu VMs in Azure with Terraform.
I am then configuring the VMs with ansible.</p>

<p>When terraform creates the VM it creates an admin user</p>

<pre><code>resource "azurerm_virtual_machine" "main" {
  ...
  ...
  os_profile {
    computer_name  = "hostname"
    admin_username = "testadmin"
    admin_password = "Password1234!"
  }
</code></pre>

<p>I will need a user to run the application and a user to run ansible.</p>

<p>Should the admin user that terraform creates be the ansible user and then get ansible to create the application user?</p>

<ansible><terraform><linux>
Which Users Should I Create With Terraform And Which With Ansible?
opticyclic
# Which Users Should I Create With Terraform And Which With Ansible?

(Asked by: username_0 on 2019-07-21)

I am creating some Ubuntu VMs in Azure with Terraform.
I am then configuring the VMs with ansible.
When terraform creates the VM it creates an admin user
resource "azurerm_virtual_machine" "main" {
  ...
  ...
  os_profile {
    computer_name  = "hostname"
    admin_username = "testadmin"
    admin_password = "Password1234!"
  }

I will need a user to run the application and a user to run ansible.
Should the admin user that terraform creates be the ansible user and then get ansible to create the application user?

**Tags:** ansible, terraform, linux


---

## 2 answers

### Answer by username_1 on 2019-07-21. Score: 1

I'd say to do it as you last explained it: using the admin user created by tf with ansible, and then create any other user using ansible.

The downside is from the security pov, does ansible needs an admin user ? If yes then keep the tf created user, if not then i'd suggest creating a new non-admin user for ansible.

As ansible is a ssh based config mgmt tool, you should think about using a strong pki.

Using the std tf admin user may results in a unique admin created on your every ubuntu vm, with the very same ssh key and this is not a very good practice (although it is a widely spread practice from my personal experience), this is where a real and strong pki may help you.

Anyway, tf needs to create an (admin) user so keep it that way, then switch to you config mgmt to handle any other required users.


---

### Answer by username_2 on 2019-07-21. Score: 0

**At the controller**, for practical reasons, it's good to create a special user who will be running commands ansible-\* as *ansible\_user*. Typically *ansible\_user* connects via ssh to remote hosts and authenticates with the public key.

* It's practical to have different ssh keys for *admin* and *ansible\_user*.
* *ansible\_user* public key will be authorized by all remote hosts.
* Some remote hosts might need the authorization to connect to the controller e.g. ansible-pull
* Typically, Ansible requires /bin/sh to be *ansible\_user* login shell at the remote host.

There might be more(or less) reasons depending on the scenario.

**At the remote host** the admin created by default might be fine with changed credentials and login-shell changed to /bin/sh. But for security reasons creating ansible\_user and deleting the default admin should be preferred.

It's good to understand [Privilege Excalation](https://docs.ansible.com/ansible/latest/user_guide/become.html#understanding-privilege-escalation) and the difference of [Ansible remote\_user vs ansible\_user](https://stackoverflow.com/questions/36668756/ansible-remote-user-vs-ansible-user).


---

