Revoke sudo permissions

tasks/main.yml

@@ -38,6 +38,25 @@
     append: yes
   loop: "{{ linux_accounts_sudo_users }}"
 
+- name: Get sudo group informations
+  getent:
+    database: group
+    key: sudo
+
+- name: "Get users in sudo group"
+  set_fact:
+    users_in_sudo_group: "{{ ansible_facts.getent_group['sudo'][2] | split(',') }}"
+
+- name: "Set accounts to revoke sudo permissions"
+  set_fact:
+    sudo_to_be_removed: "{{ users_in_sudo_group | reject('in', (linux_accounts_sudo_users)) }}"
+
+- name: "Revoke sudo permissions"
+  include_tasks: revoke-sudo.yml
+  loop: "{{ sudo_to_be_removed | difference(linux_accounts_sudo_users) }}"
+  loop_control:
+    loop_var: user
+
 - name: "Create .ssh directory for user accounts"
   file:
     path: "~{{ item.key }}/.ssh"

tasks/revoke-sudo.yml

@@ -0,0 +1,10 @@
+- name: Get groups for user '{{ user }}'
+  command: "groups {{ user }}"
+  register: current_groups
+  changed_when: false
+
+- name: Revoke 'sudo' for '{{ user }}'
+  user:
+    name: "{{ user }}"
+    groups: "{{ current_groups.stdout | replace(user + ' : ', '') | replace('sudo', '') | split }}"
+    append: no