# Community.aws.aws\_ssm broken on ubuntu-resolute-26.04-arm64? **URL:** \ **Category:** Get Help\ **Tags:** ubuntu, aws\ **Created:** [July 28, 2026, 12:59pm UTC](https://forum.ansible.com/t/community-aws-aws-ssm-broken-on-ubuntu-resolute-26-04-arm64/46095 "2026-07-28T12:59:15Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![adamatrfx](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/adamatrfx/32/9663_2.png) [@adamatrfx](https://forum.ansible.com/u/adamatrfx)\ **Post date:** [July 28, 2026, 12:59pm UTC](https://forum.ansible.com/t/community-aws-aws-ssm-broken-on-ubuntu-resolute-26-04-arm64/46095/1 "2026-07-28T12:59:15Z")
I have been running a playbook successfully on ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-arm64-server-20260610 using aws\_ssm for my ansible connection. I updated the server recently and through a lot of trial and error have discovered that when the playbook attempts to run a task with become:true, the task times out after successfully running the command. I updated to ubuntu/images/hvm-ssd-gp3/ubuntu-resolute-26.04-arm64-server-20260604. I checked the users sudo permissions using sudo -l from a playbook: > ``` > "User ssm-user may run the following commands on [server]:", > " (ALL) NOPASSWD: ALL" > > ``` which would lead me to believe that is should be working. Any thoughts on what I might be doing wrong? ---
**Author:** ![MukeshA](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mukesha/32/10085_2.png) [@MukeshA](https://forum.ansible.com/u/MukeshA)\ **Post date:** [July 28, 2026, 4:08pm UTC](https://forum.ansible.com/t/community-aws-aws-ssm-broken-on-ubuntu-resolute-26-04-arm64/46095/2 "2026-07-28T16:08:23Z")
I don`t think your doing anything wrong. Based on my research Ubuntu 26.04 (Resolute) swapped out the classic, old-school sudo for a brand-new version written in Rust called sudo-rs. Your `NOPASSWD` rule works perfectly when you are typing interactively in a normal terminal. But behind the scenes, Ansible’s `become` engine injects hidden prompt flags (like `-p "[ansible_become_prompt]..."`) so it can listen for password checks. Because `aws_ssm` runs everything through highly abstracted, non-interactive streams, the new `sudo-rs` tool gets totally confused by Ansible’s flags. Instead of executing the command or failing, it just freezes up and hangs the connection until your playbook times out. **How to fix it:** You don’t need to touch your permissions. You just need to work around the new Rust binary. Here are the easiest ways to do it: - **The easiest fix (Use the legacy wrapper):** Ubuntu 26.04 actually includes a fallback binary called `sudo.ws` that acts just like the old version. You can tell Ansible to use it in your `ansible.cfg` file: [privilege\_escalation] become = True become\_method = sudo become\_exe = sudo.ws (Or just add `ansible_become_exe=/usr/bin/sudo.ws` as a variable to that specific host in your inventory). Alternate option **The “make it behave like 24.04” fix:** If you’re building custom AMIs or just want this box to act normally, drop into the server via SSM console and ditch the Rust package entirely: sudo apt-get remove -y sudo-rs && sudo apt-get install -y sudo Hope this is helpful !! ---
**Author:** ![adamatrfx](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/adamatrfx/32/9663_2.png) [@adamatrfx](https://forum.ansible.com/u/adamatrfx)\ **Post date:** [July 28, 2026, 5:15pm UTC](https://forum.ansible.com/t/community-aws-aws-ssm-broken-on-ubuntu-resolute-26-04-arm64/46095/3 "2026-07-28T17:15:52Z")
Oh my HEAVENS I am so grateful for this community. I don’t know if I ever would have discovered this answer, thank you so much @MukeshA ! ---
**Author:** ![MukeshA](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mukesha/32/10085_2.png) [@MukeshA](https://forum.ansible.com/u/MukeshA)\ **Post date:** [July 28, 2026, 5:45pm UTC](https://forum.ansible.com/t/community-aws-aws-ssm-broken-on-ubuntu-resolute-26-04-arm64/46095/4 "2026-07-28T17:45:50Z")
@adamatrfx - Off course happy to help !! ---
**Author:** ![adamatrfx](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/adamatrfx/32/9663_2.png) [@adamatrfx](https://forum.ansible.com/u/adamatrfx)\ **Post date:** [July 30, 2026, 1:32pm UTC](https://forum.ansible.com/t/community-aws-aws-ssm-broken-on-ubuntu-resolute-26-04-arm64/46095/5 "2026-07-30T13:32:28Z")
For anyone that might come across this post later, just wanted to fill in my experience with this solution. I added the update to my ansible.cfg, which resolved my issue on those new servers but then caused my older servers to fail. In my ignorance, I expected that sudo.ws existed on the older servers but it did not. I don’t necessarily want to remove the new sudo-rs as I haven’t taken the time to understand why it was introduced to replace the previous version, so instead I added the indicated variable to the inventory for the newer servers which seems to be working well and doesn’t break the older environments. > ansible\_become\_exe: /usr/bin/sudo.ws ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [August 29, 2026, 1:32pm UTC](https://forum.ansible.com/t/community-aws-aws-ssm-broken-on-ubuntu-resolute-26-04-arm64/46095/6 "2026-08-29T13:32:56Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.