# Standard user account used for initiating builds / rollouts using Ansible

**URL:** <https://forum.ansible.com/t/standard-user-account-used-for-initiating-builds-rollouts-using-ansible/17338>\
**Category:** Ansible Project\
**Created:** [January 21, 2015, 12:55pm UTC](https://forum.ansible.com/t/standard-user-account-used-for-initiating-builds-rollouts-using-ansible/17338 "2015-01-21T12:55:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stuart\_Budd](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@Stuart\_Budd](https://forum.ansible.com/u/Stuart_Budd)\
**Post date:** [January 21, 2015, 12:55pm UTC](https://forum.ansible.com/t/standard-user-account-used-for-initiating-builds-rollouts-using-ansible/17338/1 "2015-01-21T12:55:44Z")

</div>

Hi

I have a general question please with regards to what account I should use as the \* standard \* user for initiating Ansible deployments / rollouts.

I know that the use of the term \* standard \* could be a little tricky, but in general, when starting a new environment at a new site what account should I use as the “Ansible deployment account”.

I have experienced one environment just using the root user, and then connecting at the root user on the remote servers.  
I have also experienced people just using their own accounts and adding them to a group called ansible that owns all of the deployment files.

I was thinking of just using the account ansible on the local Ansible server, which then connects to remote ansible users on the remote servers.  
Then doing a sudo to root if required - which it will in most cases I guess.

Using the root user seems wrong and using individual accounts does not seem very tidy.

Do others use a special ansible account for deployments?

Just looking for thoughts to confirm if I am doing the right thing.  
It’s lonely being the person setting things up and making the standards.

---

<div class="post-metadata">

**Author:** ![Stuart\_Budd](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@Stuart\_Budd](https://forum.ansible.com/u/Stuart_Budd)\
**Post date:** [January 21, 2015, 12:56pm UTC](https://forum.ansible.com/t/standard-user-account-used-for-initiating-builds-rollouts-using-ansible/17338/2 "2015-01-21T12:56:48Z")

</div>

p.s. Nice product.

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [January 21, 2015, 2:08pm UTC](https://forum.ansible.com/t/standard-user-account-used-for-initiating-builds-rollouts-using-ansible/17338/3 "2015-01-21T14:08:50Z")

</div>

The account usage is normally a constraint of your security  
requirements, using a common account might be tidy but obscures  
auditability. It is much easier to manage a single user's permissions  
than multiple users, shared passwords or sudo w/o a password can also  
be an issue. A case can be made for each type of setup.

yes, \*standard\* in this context is mostly the absence of one.

---

<div class="post-metadata">

**Author:** ![Stuart\_Budd](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@Stuart\_Budd](https://forum.ansible.com/u/Stuart_Budd)\
**Post date:** [January 21, 2015, 8:08pm UTC](https://forum.ansible.com/t/standard-user-account-used-for-initiating-builds-rollouts-using-ansible/17338/4 "2015-01-21T20:08:08Z")

</div>

Thanks for the reply Brian