Remote Host User Security

[PeterChrz]

Hi!,
I'm trying to understand how to best setup my remote host user account permissions. SSH is configured, but I would love to limit the scope of what the service account running ansible commands is able to perform. I understand the service account will require some sudo access in order to install system packages or control systemctl, etc but I would like to limit it's abilities past that point.

Reading the book at chapter 11 line 200 it mentions the potential of setting nopasswd to specific commands.
https://github.com/geerlingguy/ansible-for-devops-manuscript/blob/master/chapter11.txt

I've tried this in a test:
<user> ALL=(ALL) NOPASSWD: /usr/bin/apt, /usr/bin/apt-get, /bin/systemctl

The playbook I'm running installs a package, and ensures it is started and enabled in systemctl.

Now when I log into the host myself I can install packages without a password in Ubuntu, Ansible though is failing saying "Missing sudo password". It looks like it might need sudo access to /usr/bin/python3?

Does anyone have experience with issues at their companies with service accounts with too much access getting flagged? Is this a valid concern? Having Ansible connected to all my systems with full root access seems like a dangerous setup. I'm not a security expert and would love to hear how people deal with this.