title: Ansible become and privileges best practices
body: <p>I use Ansible to manage containers. I'm looking to be sure I follow best practices with users when I deploy. On that note:</p>
  
  <ol>
  <li>Most of my playbooks have the become statements below. This (I think) is required for most activities, such as installing packages, moving system-wide configuration files, and adding/updating users. What do you do?</li>
  </ol>
  
  <pre>
      become: yes
      become:method: sudo
  </pre>
  
  <ol start="2">
  <li><p>Should I have a new user on the host to deploy to? Related to #1, I could modify this user's sudoers access to allow apt and other packages, but that is quite a bit of work and may change as modules change. It would allow me to isolate the user from SSH access if that were ever needed.</p></li>
  <li><p>I'm not aware of other practices I should be following related to properly (in terms of security) applying a configuration management system. Did I miss anything?</p></li>
  </ol>