# 'community.aws.aws\_ssm' connection will not change/become user

**URL:** <https://forum.ansible.com/t/community-aws-aws-ssm-connection-will-not-change-become-user/6050>\
**Category:** Get Help\
**Tags:** aws\
**Created:** [May 29, 2024, 8:30am UTC](https://forum.ansible.com/t/community-aws-aws-ssm-connection-will-not-change-become-user/6050 "2024-05-29T08:30:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Funnionz](https://avatars.discourse-cdn.com/v4/letter/f/f08c70/32.png) [@Funnionz](https://forum.ansible.com/u/Funnionz)\
**Post date:** [May 29, 2024, 8:30am UTC](https://forum.ansible.com/t/community-aws-aws-ssm-connection-will-not-change-become-user/6050/1 "2024-05-29T08:30:23Z")

</div>

Hi,

Despite efforts, I cannot get the ‘community.aws.aws\_ssm’ connection to ‘become’ any other user when connecting to an EC2 via SSM.

I can connect to the host fine, but any attempt to become root fails. Example tests:

```auto
- name: Run 'whoami' command
  become: true
  vars:
    - ansible_aws_ssm_access_key_id: "{{ ansible_access_key }}"
    - ansible_aws_ssm_secret_access_key: "{{ ansible_secret_key }}"
    - ansible_aws_ssm_session_token: "{{ ansible_session_token }}"
  ansible.builtin.command: whoami
  register: whoami_output

- name: Run 'whoami' command again
  become: true
  become_user: root
  vars:
    - ansible_aws_ssm_access_key_id: "{{ ansible_access_key }}"
    - ansible_aws_ssm_secret_access_key: "{{ ansible_secret_key }}"
    - ansible_aws_ssm_session_token: "{{ ansible_session_token }}"
  ansible.builtin.command: whoami
  register: whoami_output

```

The results of these and other tests all come back the same: user being ‘ssm\_user’. The ‘ssm\_user’ definitely does have the permission to elevate to root and can do so manually on the instance fine.

Is anyone else experiencing the same?

---

<div class="post-metadata">

**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\
**Post date:** [May 29, 2024, 9:50am UTC](https://forum.ansible.com/t/community-aws-aws-ssm-connection-will-not-change-become-user/6050/2 "2024-05-29T09:50:13Z")

</div>

Hi  
Did you try to add `become_method:` su or sudo in your task to check if results is the same or different ?

I assume when you switch from ssm\_user to root manually you run something like `su` or `su - ` right?

---

<div class="post-metadata">

**Author:** ![Funnionz](https://avatars.discourse-cdn.com/v4/letter/f/f08c70/32.png) [@Funnionz](https://forum.ansible.com/u/Funnionz)\
**Post date:** [May 31, 2024, 2:52am UTC](https://forum.ansible.com/t/community-aws-aws-ssm-connection-will-not-change-become-user/6050/3 "2024-05-31T02:52:43Z")

</div>

Thanks for the response.

I have tried ‘become\_method’ of ‘sudo’ and ‘su’, both have no impact.

I have also tried using ‘shell’ instead of ‘command’ as well as other tasks, again the user remains as ‘ssm-user’.

---

<div class="post-metadata">

**Author:** ![motorbass](https://avatars.discourse-cdn.com/v4/letter/m/13edae/32.png) [@motorbass](https://forum.ansible.com/u/motorbass)\
**Post date:** [May 31, 2024, 7:38am UTC](https://forum.ansible.com/t/community-aws-aws-ssm-connection-will-not-change-become-user/6050/4 "2024-05-31T07:38:39Z")

</div>

Weird… I assume your root account is configured with a password too ?

Are you able to test it by providing the root password into `ansible_become_password` in your vars ?

Then try again with your current tasks, then with become\_method and see if results is the same for those scenarios.

---

<div class="post-metadata">

**Author:** ![Funnionz](https://avatars.discourse-cdn.com/v4/letter/f/f08c70/32.png) [@Funnionz](https://forum.ansible.com/u/Funnionz)\
**Post date:** [June 4, 2024, 3:21am UTC](https://forum.ansible.com/t/community-aws-aws-ssm-connection-will-not-change-become-user/6050/5 "2024-06-04T03:21:59Z")

</div>

Root account isnt configured with a password in my case. Connecting via SSM as ssm-user then elevating has always been the way.

This seems to be an issue with the plugin itself, as when I just use the ‘shell’ module and run the same commands with sudo in front it works fine. But any use of ‘become’ after connecting via the SSM plugin does not work at all.

---

<div class="post-metadata">

**Author:** ![Funnionz](https://avatars.discourse-cdn.com/v4/letter/f/f08c70/32.png) [@Funnionz](https://forum.ansible.com/u/Funnionz)\
**Post date:** [June 12, 2024, 7:28am UTC](https://forum.ansible.com/t/community-aws-aws-ssm-connection-will-not-change-become-user/6050/6 "2024-06-12T07:28:11Z")

</div>

Sorry, does anyone have any answer on this at all?

---

<div class="post-metadata">

**Author:** ![MattLehner](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mattlehner/32/9171_2.png) [@MattLehner](https://forum.ansible.com/u/MattLehner)\
**Post date:** [July 28, 2025, 11:13pm UTC](https://forum.ansible.com/t/community-aws-aws-ssm-connection-will-not-change-become-user/6050/7 "2025-07-28T23:13:42Z")

</div>

This is an old thread now, but posting an update for anyone who comes across it.

We are running ansible inside AWS CodeBuild, with the aws\_ssm connection plugin and a custom SSM Document that specifies `runAsEnabled = true` and `runAsDefaultUser = "ssm-user"`.

By default CodeBuild runs all commands as root, and aws\_ssm will set remote\_user = root since it uses the user running ansible instead of the `runAsDefaultUser` user from the SSM document. Because of this, ansible thinks the remote is using root and skips become. We had been using running ansible with aws\_ssm successfully in development and EC2 instances in production, so it was confusing why it was failing when we moved to CodeBuild.

Setting the following environment variable worked for us.

`ANSIBLE_BECOME_ALLOW_SAME_USER=1`