# Per machine credentials for privileges escalation using AWX

**URL:** <https://forum.ansible.com/t/per-machine-credentials-for-privileges-escalation-using-awx/31457>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [October 11, 2019, 12:00pm UTC](https://forum.ansible.com/t/per-machine-credentials-for-privileges-escalation-using-awx/31457 "2019-10-11T12:00:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonas\_Husser](https://avatars.discourse-cdn.com/v4/letter/j/7cd45c/32.png) [@Jonas\_Husser](https://forum.ansible.com/u/Jonas_Husser)\
**Post date:** [October 11, 2019, 12:00pm UTC](https://forum.ansible.com/t/per-machine-credentials-for-privileges-escalation-using-awx/31457/1 "2019-10-11T12:00:03Z")

</div>

Hi,

This is a crosspost from [https://devops.stackexchange.com/questions/9017/per-machine-credentials-for-privileges-escalation-using-awx](https://devops.stackexchange.com/questions/9017/per-machine-credentials-for-privileges-escalation-using-awx) because I couldn’t get an answer there.

I have an inventory with a lot of hosts in it using the same credentials, but one host needs a different approach. For the ssh connection a different user is used, after the connection is established, we do a privilege escalation with su.

This all works fine when I create a job template in AWX and limit it to this “special” host. But the job template needs to be executed on all hosts. So I want to set the default credentials in the job template, and on this single host I’d like to set the credentials as host variables using

- ansible\_become
- ansible\_user
- ansible\_password
- ansible\_become\_method
- ansible\_become\_user
- ansible\_become\_pass

Of course I don’t want the password to be in plain text in AWX so I read something about the vaults. But if I’m understood that correctly, this means I need to create a new credential in AWX and assign it to the job. But that doesn’t work for me, because than I can’t connect to the other hosts.

Is there a possibility to assign the `ansible_become_pass` encrypted to this single host?

I know that the easiest way is to use the same credentials as on the other hosts, but unfortunately this is not possible in this case.

Thanks for any help.

---

<div class="post-metadata">

**Author:** ![iamlightsocialxen](https://avatars.discourse-cdn.com/v4/letter/i/ee59a6/32.png) [@iamlightsocialxen](https://forum.ansible.com/u/iamlightsocialxen)\
**Post date:** [October 16, 2019, 3:02am UTC](https://forum.ansible.com/t/per-machine-credentials-for-privileges-escalation-using-awx/31457/2 "2019-10-16T03:02:42Z")

</div>

If i understood your requirement correctly then i think you need to use custom credential

[https://jpmens.net/2019/04/16/custom-credentials-in-ansible-tower-awx/](https://jpmens.net/2019/04/16/custom-credentials-in-ansible-tower-awx/)

---

<div class="post-metadata">

**Author:** ![Jonas\_Husser](https://avatars.discourse-cdn.com/v4/letter/j/7cd45c/32.png) [@Jonas\_Husser](https://forum.ansible.com/u/Jonas_Husser)\
**Post date:** [October 16, 2019, 2:07pm UTC](https://forum.ansible.com/t/per-machine-credentials-for-privileges-escalation-using-awx/31457/3 "2019-10-16T14:07:45Z")

</div>

Hi Prakash,

Thanks for your input, this looks good, I’ll give it a try and post an update here.