Blog · 2026-07-30

StigReady Base + StigForge roles

StigReady Base gives you the STIG disk layout and cloud hardening. StigForge gives you public Ansible roles for CIS and DISA STIG, generated from the SSG datastream and scored by OpenSCAP on the StigApplied images that bake them. Together they are the bring-your-own remediation path. For a pricing-focused comparison, see Base vs Applied.

The two paths

• StigReady Applied — a CIS or STIG AMI that is already remediated, scored in-build, with an evidence bundle on request. See Applied and the score table.
• StigReady Base + StigForge — run Base, then a public role from github.com/stigready in your own playbooks or image bake. You control when remediation runs and how you re-score.

Use Base + roles when you already have Ansible pipelines, need to tune exceptions, or want the same role in Packer that you run on fleets. Use Applied when you want the score on day one, and the evidence on request, without wiring OpenSCAP yourself.

What Base already did for you

Every Base AMI is patched at bake and boot-tested on Nitro EC2. On the images built from the official OS ISO, the STIG partition layout (/home, /tmp, /var, /var/log, /var/log/audit, /var/tmp) is applied at install — that layout is painful to retrofit later. Amazon Linux 2023 is built from Amazon's prebuilt disk image and gets a separate /var/log/audit, the one partition its STIG requires. SSH is key-only; IMDSv2 is enforced; SSM Agent is present. Details: STIG disk layout that won't fight you.

Start from the Base catalog on stigready.com: StigReady Base is on AWS Marketplace, and the catalog links each image to its listing. You can also browse our seller page or contact us. RHEL images are BYOL — you bring a Red Hat subscription.

What StigForge roles add

Each public role repo (*-cis / *-stig) is a Galaxy-style Ansible role with an immutable per-tag manifest under compliance/releases/ (factory commit, SSG version, content digest). The score is measured by OpenSCAP against the raw, unmodified SSG profile on the StigApplied image that bakes the role, with a 90% floor; those scores live on stigready.com/#applied-tier.

Install with a pinned tag (example: v0.3.49, the newest on 2026-10-24; take the newest from the role repo's tags). Do not float on main.

Hands-on next

• Base vs Applied: which do you actually need?
• STIG disk layout that won't fight you
• RHEL 9 Base + rhel9_stig
• Ubuntu 24.04 Base + ubuntu24_cis

More how-tos will land on the blog as we publish them.

Questions? contact@stigready.com