Blog · 2026-07-30 · Hands-on

Ubuntu 24.04 Base + ubuntu24_cis

Launch StigReady Ubuntu 24.04 Base from AWS Marketplace, then apply the public StigForge role ubuntu24_cis. Defaults target CIS Level 1; Level 2 evidence ships in the same release tree.

Before you start

An AWS account and permission to subscribe on Marketplace
Ansible 2.16+ on a control host that can SSH to the instance
Role pin used in this post: v0.2.4-private-review — check stigready/ubuntu24-cis for newer tags

1. Subscribe and launch Base

Open the StigReady seller page on AWS Marketplace.
Choose StigReady Ubuntu 24.04 - Minimal STIG-Ready Base for your arch (x86_64 or arm64).
Subscribe, then launch with a key pair you control.
SSH as ubuntu (or use SSM Session Manager).

ssh -i your-key.pem ubuntu@<instance-ip>

2. Install the role (pinned tag)

# requirements.yml
roles:
  - src: https://github.com/stigready/ubuntu24-cis
    scm: git
    version: v0.2.4-private-review
    name: ubuntu24_cis

ansible-galaxy role install -r requirements.yml -p ./roles

3. Run the playbook

# inventory.ini
[stig]
ubuntu24-base ansible_host=<instance-ip> ansible_user=ubuntu

# site.yml
- hosts: stig
  become: true
  roles:
    - role: ubuntu24_cis

ansible-playbook -i inventory.ini site.yml

The role default profile is cis-l1 (stigforge_profile in defaults/main.yml). CIS Level 2 OpenSCAP evidence for the same release is under compliance/releases/…/cis-l2/ — use that when your policy requires L2, and prefer Applied CIS L2 AMIs if you want L2 scored at bake without wiring it yourself.

4. Check published evidence

L1 evidence: compliance/releases/0.2.4-private-review/cis-l1
L2 evidence: …/cis-l2
Matrix scores: stigready.com/#stigforge
Re-prove: make prove RELEASE=0.2.4-private-review in the role repo

Questions? contact@stigready.com