Which Users Should I Create With Terraform And Which With Ansible?

Question

I am creating some Ubuntu VMs in Azure with Terraform. I am then configuring the VMs with ansible.

When terraform creates the VM it creates an admin user

resource "azurerm_virtual_machine" "main" {
  ...
  ...
  os_profile {
    computer_name  = "hostname"
    admin_username = "testadmin"
    admin_password = "Password1234!"
  }

I will need a user to run the application and a user to run ansible.

Should the admin user that terraform creates be the ansible user and then get ansible to create the application user?

Answer 1

I'd say to do it as you last explained it: using the admin user created by tf with ansible, and then create any other user using ansible.

The downside is from the security pov, does ansible needs an admin user ? If yes then keep the tf created user, if not then i'd suggest creating a new non-admin user for ansible.

As ansible is a ssh based config mgmt tool, you should think about using a strong pki.

Using the std tf admin user may results in a unique admin created on your every ubuntu vm, with the very same ssh key and this is not a very good practice (although it is a widely spread practice from my personal experience), this is where a real and strong pki may help you.

Anyway, tf needs to create an (admin) user so keep it that way, then switch to you config mgmt to handle any other required users.

Answer 2

At the controller, for practical reasons, it's good to create a special user who will be running commands ansible-* as ansible_user. Typically ansible_user connects via ssh to remote hosts and authenticates with the public key.

• It's practical to have different ssh keys for admin and ansible_user.

• ansible_user public key will be authorized by all remote hosts.

• Some remote hosts might need the authorization to connect to the controller e.g. ansible-pull

• Typically, Ansible requires /bin/sh to be ansible_user login shell at the remote host.

There might be more(or less) reasons depending on the scenario.

At the remote host the admin created by default might be fine with changed credentials and login-shell changed to /bin/sh. But for security reasons creating ansible_user and deleting the default admin should be preferred.

It's good to understand Privilege Excalation and the difference of Ansible remote_user vs ansible_user.