Community.aws.aws_ssm broken on ubuntu-resolute-26.04-arm64?

Get Help
,
1

I have been running a playbook successfully on ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-arm64-server-20260610 using aws_ssm for my ansible connection.

I updated the server recently and through a lot of trial and error have discovered that when the playbook attempts to run a task with become:true, the task times out after successfully running the command.

I updated to ubuntu/images/hvm-ssd-gp3/ubuntu-resolute-26.04-arm64-server-20260604.

I checked the users sudo permissions using sudo -l from a playbook:

    "User ssm-user may run the following commands on [server]:",
    "    (ALL) NOPASSWD: ALL"

which would lead me to believe that is should be working.

Any thoughts on what I might be doing wrong?

2

I don`t think your doing anything wrong. Based on my research Ubuntu 26.04 (Resolute) swapped out the classic, old-school sudo for a brand-new version written in Rust called sudo-rs.

Your NOPASSWD rule works perfectly when you are typing interactively in a normal terminal. But behind the scenes, Ansible’s become engine injects hidden prompt flags (like -p "[ansible_become_prompt]...") so it can listen for password checks. Because aws_ssm runs everything through highly abstracted, non-interactive streams, the new sudo-rs tool gets totally confused by Ansible’s flags. Instead of executing the command or failing, it just freezes up and hangs the connection until your playbook times out.

How to fix it:
You don’t need to touch your permissions. You just need to work around the new Rust binary. Here are the easiest ways to do it:

  • The easiest fix (Use the legacy wrapper): Ubuntu 26.04 actually includes a fallback binary called sudo.ws that acts just like the old version. You can tell Ansible to use it in your ansible.cfg file:

[privilege_escalation]
become = True
become_method = sudo
become_exe = sudo.ws
(Or just add ansible_become_exe=/usr/bin/sudo.ws as a variable to that specific host in your inventory).

Alternate option

The “make it behave like 24.04” fix: If you’re building custom AMIs or just want this box to act normally, drop into the server via SSM console and ditch the Rust package entirely:

sudo apt-get remove -y sudo-rs && sudo apt-get install -y sudo

Hope this is helpful !!

3

Oh my HEAVENS I am so grateful for this community.

I don’t know if I ever would have discovered this answer, thank you so much @MukeshA !

4

@adamatrfx - Off course happy to help !!