Turns out we don't need sudo for any of these, the provisioning steps are run as root