How to Fix Ansible Bootstrap Playbooks Failing on Fresh Cloud Servers

Ansible bootstrap playbooks often fail on the first run against newly created cloud instances due to a timing race between the control node and cloud-init, which hasn't finished configuring SSH and user accounts when Ansible attempts its first connection. Common symptoms include SSH connection refusals, sudo password errors, and dpkg lock conflicts — all stemming from the same root cause rather than separate bugs. The issue affects major cloud providers including AWS EC2, Hetzner, and DigitalOcean. The recommended fix is to use Ansible's built-in wait_for_connection module as the first task in the playbook, combined with a wait_for check on the cloud-init completion marker at /var/lib/cloud/instance/boot-finished. Developers should also set gather_facts: false at the play level to prevent Ansible from attempting fact-gathering before readiness checks have passed.