---
- name: Deploy sudoers.d drop-in file per AD group
  ansible.builtin.template:
    src: sudoers_group.j2
    dest: "/etc/sudoers.d/10-{{ item.group | lower }}"
    owner: root
    group: root
    mode: "0440"
    validate: "visudo -cf %s"
  loop: "{{ sudo_rbac_rules }}"
  loop_control:
    label: "{{ item.group }}"
  tags: [sudo_rbac]

- name: Restrict direct root console login
  ansible.builtin.lineinfile:
    path: /etc/securetty
    state: absent
    regexp: "^tty[1-9]$"
  tags: [sudo_rbac, cis_hardening]

- name: Audit rule for privileged command usage
  ansible.builtin.lineinfile:
    path: /etc/audit/rules.d/50-privileged.rules
    create: true
    owner: root
    group: root
    mode: "0640"
    line: "-a exit,always -F arch=b64 -C euid!=uid -F auid!=unset -S execve -k privileged"
  notify: reload auditd rules
  tags: [sudo_rbac, cis_hardening]