Ansible 10 Shell vs Command module

Hello DevSecOps Automation learners!! You can do wonders by learning Ansible Automations along with me.

The Ansible can run the command module as default that is you don't need to mentioned with -m option for command. That means when you don't mention any module then it is working with the 'command module'

Ansible Shell vs Command module

Here we will execute in details of experiment with 4 different use cases which could be part of your automation playbook construct:

1. Both operate similarly
2. When redirect operator used
3. When pipes used between commands
4. Multiple commands need to run

Let's examine these use cases

1. Both operate similarly

If we need to run single Linux command to be executed then both shell, commands modules operates same way there is no difference. Here I'm using "who -r" command to be run. If we don't mention any module name then command module by default.

# Using default command module
ansible web -a "who -r"

#or
ansible web -m command -a "who -r"

# trying with localhost also fine
ansible localhost -m command -a "who -r"

# using shell module here	
ansible web -m shell -a "who -r"

Image

Ansible Shell vs Command module usage

2. When the redirection operator used

when we need to store the command execution stdout to a file we will be either using redirection operator such as greater-than or double greater-than operators. Let's see the execution of whoami command output store to user.dat file.

# Using shell module creating a redirecting file
ansible localhost -m shell -a "whoami >user.dat"

3. When pipe used between commands

Command has its limitation to execute single Linux command and output it. whereas, shell can be used for multiple commands with pipe operator allowed. let's see how it works here:

# Using shell module with pipe
ansible web -m shell -a "who -r|awk -F' ' '{print $3}'"

# pipe is not allowed in the command module ...  so fails 
ansible web -m command  -a "who -r|awk -F' ' '{print $3}'"

Image:

Ansible Shell vs Command module using pipe

4. When multiple commands to be run

If you need to run the multiple Linux commands, where we can use either double-ampersand && or semi-colon ; operators in between those Linux commands, This can works good with Shell module but doesn't works with command module. Hence we need to understand the limitations of command module.

# works good with shell
ansible web -m shell -a "who -r && uptime"

# fails to output with command module 
ansible web -m command -a "who -r && uptime"

# command fails when ; used
ansible web -m command -a "who -r; uptime"

# It is okay for shell module for ; separate multiple commands
ansible web -m shell -a "who -r; uptime"

The execution of the above commands output Image:

Ansible Shell vs Command module using && and ;

Conclusion: 

If you want to run a command securely and predictably, it may be better to use the 'command module'.

Ansible 'shell module' can run most commands that can run from bash script or CLI. They are powerful, but also opens up the doors for attachers so be careful.

 There is no file storage and usage of the process to process piped for connecting one command with other in command module not possible. You can see the error when you use '>' or '|; with com