ansible aws windows ec2 - Internal Error: this connection module does not support running commands via sudo

Question

I am getting below error when I am trying to run one playbook which connects to Windows machine hosted on AWS EC2. I enabled winrm and win_ping worked fine but when I am invoking ansible-playbook I am not sure why it is using sudo as if the target machine is Linux host.

I tried disabling become=True in ansible.cfg but same issue occurred.

Is it compulsory to use ansible_winrm_transport=ntlm for the win_ping to work. I feel that is causing this issue.

Any help would be appreciated.

fatal: [10.0.150.18]: FAILED! => {"failed": true, "msg": "Internal Error: this connection module does not support running commands via sudo"}

[root@localhost ]# cat ansible.cfg
[defaults]
log_path=/var/log/ansible.log
ansible_winrm_operation_timeout_sec = 200
ansible_winrm_read_timeout_sec = 500

[privilege_escalation]
become=True

[root@localhost ]# ansible --version
ansible 2.2.0.0

[root@localhost ]# cat hosts
[localhost]
localhost ansible_connection=local

[marcel]
10.0.150.18  ansible_user=Administrator ansible_password=xxxxxxxxxx ansible_port=5985 ansible_connection=winrm ansible_winrm_server_cert_validation=ignore ansible_winrm_transport=ntlm

Answer 1

According to the documentation:

Prior to Ansible 2.4, become would only work when ansible_winrm_transport was set to either basic or credssp, but since Ansible 2.4 become now works on all transport types.

You're using Ansible 2.2. Might that be it? The error message might be a bit misleading.

Answer 2

You should try adding an entry to your priviledge escalation section.

Set become_method to runas. So in my opinion just change the become_method to runas and it should work just fine.

Do make sure the ports 5985/5986 are opened in the security group from the AWS console and try again. Do post the logs if you can.