Say I want to execute the following command on target hosts (deployed on GCP): ansible all -a "head -1 /etc/shadow". The command demands the root access. With the default Ansible configuration, I get the following error:

host1 | FAILED | rc=1 >>
head: cannot open '/etc/shadow' for reading: Permission deniednon-zero return code

Hence, I extended my ansible.cfg to include the following:

remote_user = gcp_user

Despite these changes, I can't run the command mentioned above. I still get the same error. I am, however, capable of executing the following command: ansible all -a "sudo cat /etc/shadow"

Thus, it seems that become_user=yes does not take any effect.

  • Try without sudo and --become as argument Commented May 29, 2023 at 11:31

1 Answer 1


Running ansible with -vvv will tell you which ansible config you're using

For instance

me@mycomputer:~$ ansible -vvv -m setup localhost
ansible 2.10.8
  config file = None

shows that I'm not using any config file

chances are pretty OK that is what is happening to you too. ansible.cfg should be in the current directory or ~/.ansible (maybe some other places depending on how you installed ansible) you can specify where it is with ANSIBLE_CONFIG=/path/to/config in your environment variables

The other thing is, the parameters you used in the config file are actually the parameters that go in the playbook, not in the config file


explains where they go in the config file.

When you're running adhoc tasks, you can use them on the commandline (as you wrote) with -e remote_user=gcp_user -e ansible_become=yes -e ansible_become_method=sudo -e ansible_become_user=root


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.