---
- name: Ensure sudo access is logged
  copy:
    dest: /etc/sudoers.d/logfile.conf
    owner: root
    group: root
    mode: "0644"
    content: |
      Defaults logfile="/var/log/sudo.log"