provision_management_user/molecule/with_ssh_keys/verify.yml

---
- name: Verify
  hosts: all
  gather_facts: true
  become: true
  tasks:
    - name: "Test: ubuntu user and group"
      block:
        - name: "Getent user ansible"
          ansible.builtin.getent:
            database: passwd
            key: ubuntu
          register: ednz_cloud_management_user

        - name: "Getent group ubuntu"
          ansible.builtin.getent:
            database: group
            key: ubuntu
          register: ednz_cloud_management_group

        - name: "Verify ubuntu user and group"
          ansible.builtin.assert:
            that:
              - not ednz_cloud_management_user.failed
              - not ednz_cloud_management_group.failed
              - "'ubuntu' in ednz_cloud_management_user.ansible_facts.getent_passwd.keys()"
              - "'/home/ubuntu' in ednz_cloud_management_user.ansible_facts.getent_passwd['ubuntu']"
              - "'/bin/bash' in ednz_cloud_management_user.ansible_facts.getent_passwd['ubuntu']"
              - "'ubuntu' in ednz_cloud_management_group.ansible_facts.getent_group.keys()"

    - name: "Test: ubuntu sudo permissions"
      block:
        - name: "Stat file /etc/sudoers.d/ubuntu"
          ansible.builtin.stat:
            path: "/etc/sudoers.d/ubuntu"
          register: stat_etc_sudoers_d_ubuntu

        - name: "Slurp file /etc/sudoers.d/ubuntu"
          ansible.builtin.slurp:
            src: "/etc/sudoers.d/ubuntu"
          register: slurp_etc_sudoers_d_ubuntu

        - name: "Verify file /etc/sudoers.d/ubuntu"
          ansible.builtin.assert:
            that:
              - stat_etc_sudoers_d_ubuntu.stat.exists
              - stat_etc_sudoers_d_ubuntu.stat.isreg
              - stat_etc_sudoers_d_ubuntu.stat.pw_name == 'root'
              - stat_etc_sudoers_d_ubuntu.stat.gr_name == 'root'
              - stat_etc_sudoers_d_ubuntu.stat.mode == '0440'
              - "'ubuntu ALL=NOPASSWD:SETENV: ALL' in (slurp_etc_sudoers_d_ubuntu.content|b64decode)"

    - name: "Test: ubuntu authorized_keys"
      block:
        - name: "Stat file /home/ubuntu/.ssh/authorized_keys"
          ansible.builtin.stat:
            path: "/home/ubuntu/.ssh/authorized_keys"
          register: stat_home_ubuntu_ssh_authorized_keys

        - name: "Slurp file /home/ubuntu/.ssh/authorized_keys"
          ansible.builtin.slurp:
            src: "/home/ubuntu/.ssh/authorized_keys"
          register: slurp_home_ubuntu_ssh_authorized_keys

        - name: "Verify file /home/ubuntu/.ssh/authorized_keys"
          ansible.builtin.assert:
            that:
              - stat_home_ubuntu_ssh_authorized_keys.stat.exists
              - stat_home_ubuntu_ssh_authorized_keys.stat.isreg
              - stat_home_ubuntu_ssh_authorized_keys.stat.pw_name == 'ubuntu'
              - stat_home_ubuntu_ssh_authorized_keys.stat.gr_name == 'ubuntu'
              - stat_home_ubuntu_ssh_authorized_keys.stat.mode == '0600'
              - "'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIClfmTk73wNNL2jwvhRUmUuy80JRrz3P7cEgXUqlc5O9 ubuntu@instance' in (slurp_home_ubuntu_ssh_authorized_keys.content|b64decode)"