Want CIS or DISA STIG already applied and scored for you? Try StigApplied →
StigReady

The StigReady
Minimal Base for AWS

A clean, hardened foundation — the STIG partition layout, SSH and cloud hardening, and up-to-date packages — across Ubuntu 24.04 / 26.04 and the RHEL family (Rocky Linux 8/9/10, AlmaLinux 9/10, and BYOL RHEL 8/9).

Built fresh from the official OS ISO with Packer + QEMU, patched, and boot-tested on real EC2. Bring your own profiles, Ansible, and tooling — on a base that won't fight you.

Request Early Access View on GitHub

Coming soon to AWS Marketplace · contact us for early access.

What's in the Base

The structural work that's painful to retrofit — already done, and cloud-safe.

STIG Partition Layout

Separate mounts for /home, /tmp, /var, /var/log, /var/log/audit, /var/tmp with hardened mount options — identical across both families.

SSH Hardened

Password auth disabled, root login prohibited, host keys regenerate on first boot, and no pre-installed keys — cloud-init injects your EC2 key pair.

Minimal & Patched

Built from the official ISO with a minimal footprint and fully updated packages on a monthly cadence — no surprise packages, a smaller attack surface to defend.

AWS-Native

IMDSv2 enforced. SSM Agent pre-installed. cloud-init handles EC2 key-pair injection. Boot-tested on real Nitro EC2 before any image ships. EBS-backed, HVM, x86_64.

Base Catalog

One hardened base per OS — the same STIG layout and hardening across Debian and RHEL.

Base image Family Availability
Ubuntu 24.04 LTS Debian Early access
Ubuntu 26.04 LTS Debian Early access
Rocky Linux 8 RHEL Early access
Rocky Linux 9 RHEL Early access
Rocky Linux 10 RHEL Early access
AlmaLinux 9 RHEL Early access
AlmaLinux 10 RHEL Early access
Red Hat Enterprise Linux 8 RHEL BYOL — on request
Red Hat Enterprise Linux 9 RHEL BYOL — on request
Red Hat Enterprise Linux 10 RHEL Coming soon

Each base is the same across the fleet: minimal, patched, and laid out the way the hardening you'll apply expects.

BYOL — genuine Red Hat images ship without entitlement; you attach your own Red Hat subscription. Talk to us about a RHEL base.

Partition Layout

GPT disk · LVM volume group vg_root · separate STIG filesystems on every image

Mount Filesystem Options
/boot/efivfat—
/bootext4 / xfs—
/xfs—
/homexfsnodev,nosuid
/tmpxfsnodev,nosuid,noexec
/varxfsnodev,nosuid
/var/tmpxfsnodev,nosuid,noexec
/var/logxfsnodev,nosuid,noexec
/var/log/auditxfsnodev,nosuid,noexec
swapswap—

The separate-filesystem layout the DISA STIG and CIS benchmarks expect — so the profile you apply has less to fix.

How It Works

1

Pick your OS

Choose Ubuntu 24.04/26.04 or the RHEL family (Rocky 9, Alma 9, or BYOL RHEL 9/10). Request early access while Marketplace listings roll out.

2

Launch

EC2 injects your key pair on first boot via cloud-init. Connect as ubuntu or ec2-user over SSH with key-based auth.

3

Apply your profiles

Apply your own profiles, auditd rules, and application hardening on a base that already carries the STIG layout — nothing to undo first.

Pricing

Planned Marketplace pricing — pay only the software fee on top of your normal EC2 costs.

$0.02/hr

or $149/yr per instance (~15% savings)

Base software fee at launch · EC2 instance costs billed separately by AWS

Annual contracts and Private Offers available. Contact us for RHEL-family (Rocky/Alma), BYOL RHEL, or volume pricing.