Blog · 2026-07-30 · Hands-on

RHEL 9 Base + rhel9_stig

Apply the public StigForge role rhel9_stig on StigReady RHEL 9 Base (BYOL) with a pinned release tag. StigReady RHEL 9 Base is on AWS Marketplace: the Base catalog links to its listing.

Before you start

A subscription to StigReady RHEL 9 Base on AWS Marketplace (the Base catalog links to its listing), or a Private Offer
A Red Hat subscription for the instance (RHEL Base is BYOL)
Ansible 2.16+ on a control host that can SSH to the instance
Role pin used in this post: v0.3.49, the newest tag on 2026-10-24 — check stigready/rhel9-stig tags for newer ones

1. Launch Base

Subscribe to RHEL 9 Base (x86_64 or arm64) from its AWS Marketplace listing, linked from the Base catalog, or browse the StigReady seller page. Contact us for a Private Offer.
Launch into your VPC with a key pair you control. Prefer a security group that allows SSH from your control host only.
SSH as ec2-user (or use SSM Session Manager — the agent is preinstalled).

ssh -i your-key.pem ec2-user@<instance-ip>

Confirm the STIG mounts exist (lsblk, findmnt) before remediating — Base already laid them down at install. See STIG disk layout that won't fight you.

2. Install the role (pinned tag)

On your Ansible control host:

# requirements.yml
roles:
  - src: https://github.com/stigready/rhel9-stig
    scm: git
    version: v0.3.49
    name: rhel9_stig

ansible-galaxy role install -r requirements.yml -p ./roles

Galaxy import (stigready.rhel9_stig) is the long-term install path once the namespace is listed; until then, GitHub + tag is the supported pin.

3. Run the playbook

# inventory.ini
[stig]
rhel9-base ansible_host=<instance-ip> ansible_user=ec2-user

# site.yml
- hosts: stig
  become: true
  roles:
    - role: rhel9_stig

ansible-playbook -i inventory.ini site.yml

Expect a reboot-friendly run: FIPS / crypto policy and auth changes may require a reboot before services settle. Plan a maintenance window.

4. Score the instance

What the role repo ships for each tag is a manifest (compliance/releases/<version>/manifest.json) pinning the factory commit, the SSG version and a content digest. It does not ship a score.

Score this host: oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig --results results.xml --report report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml, after the reboot.
Published scores for the StigReady Applied image built with this role: stigready.com/#applied-tier (the StigForge table names the role version each score was measured with)

The role repo ships no container score (container verification was retired because a container cannot evaluate most STIG rules). The number that counts is OpenSCAP against the raw SSG stig profile on this instance, after the reboot; that is also what StigReady publishes for the StigApplied image that bakes the same role.

Questions? contact@stigready.com