Move the 'become' for privilege escalation to appropiate hosts only

playbooks/wazuh-agent.yml

@@ -1,7 +1,5 @@
 ---
 - hosts: <your wazuh agents hosts>
-  become: yes
-  become_user: root
   roles:
     - ../roles/wazuh/ansible-wazuh-agent
   vars:
@@ -13,4 +11,4 @@
         api_proto: 'https'
         api_user: wazuh
         max_retries: 5
-        retry_interval: 5
+        retry_interval: 5

roles/wazuh/ansible-wazuh-agent/handlers/main.yml

@@ -1,9 +1,11 @@
 ---
 - name: restart wazuh-agent
   service: name=wazuh-agent state=restarted enabled=yes
+  become: yes
 
 - name: Windows | Restart Wazuh Agent
   win_service: name=WazuhSvc start_mode=auto state=restarted
 
 - name: macOS | Restart Wazuh Agent
-  command: /Library/Ossec/bin/wazuh-control restart
+  command: /Library/Ossec/bin/wazuh-control restart
+  become: yes

roles/wazuh/ansible-wazuh-agent/tasks/Linux.yml

@@ -1,11 +1,20 @@
 ---
-- include_tasks: "RedHat.yml"
+- include_tasks:
+    file: "RedHat.yml"
+    apply:
+      become: yes
   when: ansible_facts.os_family == "RedHat"
 
-- include_tasks: "Debian.yml"
+- include_tasks:
+    file: "Debian.yml"
+    apply:
+      become: yes
   when: ansible_facts.os_family == "Debian"
 
-- include_tasks: "installation_from_custom_packages.yml"
+- include_tasks:
+    file: "installation_from_custom_packages.yml"
+    apply:
+      become: yes
   when:
     - wazuh_custom_packages_installation_agent_enabled
 
@@ -262,10 +271,16 @@
     state: started
   tags: config
 
-- include_tasks: "RMRedHat.yml"
+- include_tasks:
+    file: "RMRedHat.yml"
+    apply:
+      become: yes
   when:
     - ansible_facts.os_family == "RedHat"
 
-- include_tasks: "RMDebian.yml"
+- include_tasks:
+    file: "RMDebian.yml"
+    apply:
+      become: yes
   when:
     - ansible_facts.os_family == "Debian"

roles/wazuh/ansible-wazuh-agent/tasks/main.yml

@@ -21,8 +21,14 @@
 - include_tasks: "Windows.yml"
   when: ansible_facts.os_family == "Windows"
 
-- include_tasks: "Linux.yml"
+- include_tasks:
+    file: "Linux.yml"
+    apply:
+      become: yes
   when: ansible_facts.system == "Linux"
 
-- include_tasks: "macOS.yml"
-  when: ansible_facts.system == "Darwin"
+- include_tasks:
+    file: "macOS.yml"
+    apply:
+      become: yes
+  when: ansible_facts.system == "Darwin"