Blog · 2026-07-30

StigReady Base + StigForge roles

StigReady Base gives you the STIG disk layout and cloud hardening from AWS Marketplace. StigForge gives you public, OpenSCAP-verified Ansible roles for CIS and DISA STIG. Together they are the bring-your-own remediation path.

The two paths

• StigReady Applied — subscribe to a CIS or STIG AMI that is already remediated, scored in-build, and ships an evidence bundle. See Applied and the score table.
• StigReady Base + StigForge — subscribe to Base, then run a public role from github.com/stigready in your own playbooks or image bake. You control when remediation runs and how you re-score.

Use Base + roles when you already have Ansible pipelines, need to tune exceptions, or want the same role in Packer that you run on fleets. Use Applied when you want the score and evidence on day one without wiring OpenSCAP yourself.

What Base already did for you

Every Base AMI is built from the official OS ISO, patched at bake, and boot-tested on Nitro EC2. The STIG partition layout (/home, /tmp, /var, /var/log, /var/log/audit, /var/tmp) is applied at install — that layout is painful to retrofit later. SSH is key-only; IMDSv2 is enforced; SSM Agent is present.

Browse listings on our AWS Marketplace seller page, or start from the Base catalog on stigready.com. RHEL images are BYOL — you bring a Red Hat subscription.

What StigForge roles add

Each public role repo (*-cis / *-stig) is a Galaxy-style Ansible role plus immutable OpenSCAP evidence under compliance/releases/. Factory CI verifies against the raw, unmodified SSG profile with a 90% floor. Published scores live on stigready.com/#stigforge.

Install with a pinned tag (example: v0.2.4-private-review). Do not float on main.

Hands-on next

• RHEL 9 Base + rhel9_stig
• Ubuntu 24.04 Base + ubuntu24_cis

More how-tos will land on the blog as we publish them.

Questions? contact@stigready.com