Blog · 2026-07-30 · Hands-on

RHEL 9 Base + rhel9_stig

Launch StigReady RHEL 9 Base from AWS Marketplace, then apply the public StigForge role rhel9_stig with a pinned release tag.

Before you start

An AWS account and permission to subscribe on Marketplace
A Red Hat subscription for the instance (RHEL Base is BYOL)
Ansible 2.16+ on a control host that can SSH to the instance
Role pin used in this post: v0.2.4-private-review — check stigready/rhel9-stig for newer tags

1. Subscribe and launch Base

Open the StigReady seller page on AWS Marketplace.
Choose StigReady RHEL 9 - Minimal STIG-Ready Base for your arch (x86_64 or arm64).
Subscribe, then launch into your VPC with a key pair you control. Prefer a security group that allows SSH from your control host only.
SSH as ec2-user (or use SSM Session Manager — the agent is preinstalled).

ssh -i your-key.pem ec2-user@<instance-ip>

Confirm the STIG mounts exist (lsblk, findmnt) before remediating — Base already laid them down at install.

2. Install the role (pinned tag)

On your Ansible control host:

# requirements.yml
roles:
  - src: https://github.com/stigready/rhel9-stig
    scm: git
    version: v0.2.4-private-review
    name: rhel9_stig

ansible-galaxy role install -r requirements.yml -p ./roles

Galaxy import (stigready.rhel9_stig) is the long-term install path once the namespace is listed; until then, GitHub + tag is the supported pin.

3. Run the playbook

# inventory.ini
[stig]
rhel9-base ansible_host=<instance-ip> ansible_user=ec2-user

# site.yml
- hosts: stig
  become: true
  roles:
    - role: rhel9_stig

ansible-playbook -i inventory.ini site.yml

Expect a reboot-friendly run: FIPS / crypto policy and auth changes may require a reboot before services settle. Plan a maintenance window.

4. Check published evidence

Factory-verified scores and artifacts for this tag live under the role repo:

Release evidence: compliance/releases/0.2.4-private-review/stig
Matrix scores: stigready.com/#stigforge
Customer re-prove helper: make prove RELEASE=0.2.4-private-review in the role repo

Your live host score can differ from docker verify (cloud exceptions, packages, timing). Use OpenSCAP against the raw SSG stig profile when you need an auditor-facing number for this instance.

Questions? contact@stigready.com