Idempotency: How to determine which user to use when root is no longer allowed?

Hi there,

say I get a new instance somewhere that allows logins as root. I want
to run a playbook that configures the machine and no longer allows
root logins. And I want it to be idempotent. :wink:

Consider this mock-up playbook: