Why command Breaks Idempotency

Worse, some commands fail or duplicate work on a repeat run, like useradd erroring because the user already exists.

For users, reach for the user module instead. It checks if the account exists and only creates it when missing, staying idempotent.

Most common shell tasks have a dedicated module: file, copy, lineinfile, git. Use them so Ansible can compare and skip when correct.

If you must use command, add creates. Ansible skips the task when that path already exists, restoring idempotency.

The mirror of creates is removes: the command runs only if the named path still exists, useful for cleanup steps.

You can also wrap a command in a when condition driven by a registered check, so it runs only when truly needed.

Set changed_when: false on a read-only command so Ansible stops reporting it as changed on every run.

The shell module shares this flaw. It runs through a shell, so it too is non-idempotent unless you guard it the same way.

Raw command is an escape hatch, not a default. Each one is a place idempotency can quietly break, so reach for it only when no module fits.

The command and shell modules always run and always report changed. Prefer real modules, or guard them with creates, removes, or changed_when. 🛡️