Ansible "Timeout waiting for privilege escalation prompt" in CI

By Kaveh Alemi·Latchkey

Ansible used become to escalate privileges, sudo printed a password prompt, and Ansible never received a password to answer it, so the escalation timed out. The default wait is short and the task aborts when it elapses.

What this error means

A task with become: true fails with "Timeout (12s) waiting for privilege escalation prompt" rather than running. It typically affects every escalated task on the host.

fatal: [app1]: FAILED! => {"msg": "Timeout (12s) waiting for privilege
escalation prompt: "}

Common causes

sudo requires a password that was not supplied

The remote account is not passwordless for sudo, so sudo prompts and Ansible has no become_pass to send, hanging until the timeout.

A slow connection outlasts the escalation timeout

On a congested link the prompt round trip exceeds the default timeout, so escalation aborts before the password is exchanged.

How to fix it

Supply the become password from a secret

1. Store the sudo password as a CI secret.
2. Pass it with --extra-vars "ansible_become_pass=..." or -K from the secret.
3. Re-run so sudo gets a password to its prompt.

ansible-playbook -i inventory site.yml \
  --extra-vars "ansible_become_pass=${{ secrets.SUDO_PASS }}"

Use passwordless sudo or raise the timeout

Grant NOPASSWD sudo to the deploy account so no prompt appears, or raise the escalation timeout for slow links.

# /etc/sudoers.d/deploy on the target host
deploy ALL=(ALL) NOPASSWD: ALL

How to prevent it

• Grant the deploy account passwordless sudo where policy allows.
• Pass ansible_become_pass from a secret when a password is required.
• Raise timeout for hosts on slow or distant links.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation