Change password first Log In sudo su with Cloud-init

I'm trying to implement this rule with cloud init but I can't, I would like the user to have a password entered by me but as soon as he executes the sudo su command, the system forces the user to change password. How can I do this via Cloud-Init? I state that the user connects in SSH and is not prompted for a password. - name: prova groups: sudo plain_text_passwd: 1234 sudo: ['ALL=(ALL) ALL'] lock_passwd: false chpasswd: {expire: True} ssh_pwauth: false I tried to do it like this but it doesn't work, can someone help me? Thank you