Blog · 2026-07-30 · Hands-on

RHEL 9 Base + rhel9_stig

Apply the public StigForge role rhel9_stig on StigReady RHEL 9 Base (BYOL) with a pinned release tag. AWS Marketplace listings are rolling out — use early access via contact until public subscribe is live.

Before you start

Access to a StigReady RHEL 9 Base AMI (early access / Private Offer, or Marketplace when listed)
A Red Hat subscription for the instance (RHEL Base is BYOL)
Ansible 2.16+ on a control host that can SSH to the instance
Role pin used in this post: v0.2.4-private-review — check stigready/rhel9-stig for newer tags

1. Launch Base

Watch the StigReady seller page for public listings, or contact us for early access to RHEL 9 Base (x86_64 or arm64).
Launch into your VPC with a key pair you control. Prefer a security group that allows SSH from your control host only.
SSH as ec2-user (or use SSM Session Manager — the agent is preinstalled).

ssh -i your-key.pem ec2-user@<instance-ip>

Confirm the STIG mounts exist (lsblk, findmnt) before remediating — Base already laid them down at install. See STIG disk layout that won't fight you.

2. Install the role (pinned tag)

On your Ansible control host:

# requirements.yml
roles:
  - src: https://github.com/stigready/rhel9-stig
    scm: git
    version: v0.2.4-private-review
    name: rhel9_stig

ansible-galaxy role install -r requirements.yml -p ./roles

Galaxy import (stigready.rhel9_stig) is the long-term install path once the namespace is listed; until then, GitHub + tag is the supported pin.

3. Run the playbook

# inventory.ini
[stig]
rhel9-base ansible_host=<instance-ip> ansible_user=ec2-user

# site.yml
- hosts: stig
  become: true
  roles:
    - role: rhel9_stig

ansible-playbook -i inventory.ini site.yml

Expect a reboot-friendly run: FIPS / crypto policy and auth changes may require a reboot before services settle. Plan a maintenance window.

4. Check published evidence

Factory-verified scores and artifacts for this tag live under the role repo:

Release evidence: compliance/releases/0.2.4-private-review/stig
Matrix scores: stigready.com/#stigforge
Customer re-prove helper: make prove RELEASE=0.2.4-private-review in the role repo

Your live host score can differ from docker verify (cloud exceptions, packages, timing). Use OpenSCAP against the raw SSG stig profile when you need an auditor-facing number for this instance.

Questions? contact@stigready.com