Blog · 2026-08-12

STIG disk layout that won't fight you

If you have ever burned a sprint carving separate filesystems onto a live AMI so OpenSCAP stops failing partition checks, you already know the pain. StigReady Base bakes that layout at OS install — so remediation starts on a disk that already matches the STIG story.

Why retrofit partitions hurt

DISA STIG and CIS profiles expect dedicated mounts for paths like /home, /tmp, /var, /var/log, /var/log/audit, and /var/tmp, often with nodev / nosuid / noexec. Doing that after first boot means shrinking root, migrating data, rewriting fstab, and hoping nothing holds open files mid-cutover. It is the structural work that fights you — and it is the wrong place to spend remediation time.

The durable fix is install-time layout: kickstart (or equivalent) creates the LVM volumes before the image ever boots in EC2.

What Base bakes in

Every StigReady Base AMI is built from the official OS ISO. At install, a GPT disk and LVM volume group vg_root get the separate STIG-aligned filesystems — identical across OS families in the catalog. Typical mounts include:

/home
/tmp
/var
/var/log
/var/log/audit
/var/tmp

Plus /, /boot, /boot/efi, and swap — the same table published on the partition layout section of stigready.com. You launch an instance that already has the layout; you do not retrofit it later.

Sizing with room to grow

Rough product sizing: the root disk lands around ~30 GB total, with roughly ~2.4 GB unallocated in vg_root. That slack is intentional — grow the EBS volume, then extend logical volumes without rebuilding the AMI. Exact LV sizes can vary by image family; treat the numbers as the sizing story, not a contractual floor.

Layout first; hardening still matters

Disk layout is the hero of this post. Base also ships patched at bake, Nitro boot-tested, SSH key-only, IMDSv2 enforced, and SSM Agent present — so the cloud control plane is ready when you attach your profiles. Those details matter; they are not a substitute for getting partitions right at install.

Base vs Applied (one sentence)

Base is $0.02/hr or $149/yr — STIG disk layout and cloud hardening, bring your own CIS/STIG roles. If you want full CIS or DISA STIG remediation plus OpenSCAP evidence on day one, look at Applied ($0.08/hr or $649/yr). Same layout story underneath; different amount of remediation already applied.

Next steps

Start from the Base catalog and pricing on stigready.com when you are ready to buy Base (or Applied for day-one remediation + evidence). Questions: contact@stigready.com. You can also browse Base on our AWS Marketplace seller page as listings roll out — we do not publish per-SKU Marketplace URLs here.