Blog · 2026-07-30 · Hands-on

Ubuntu 24.04 Base + ubuntu24_cis

Apply the public StigForge role ubuntu24_cis on StigReady Ubuntu 24.04 Base. Defaults target CIS Level 1; Level 2 evidence ships in the same release tree. AWS Marketplace listings are rolling out — use early access via contact until public subscribe is live.

Before you start

Access to a StigReady Ubuntu 24.04 Base AMI (early access / Private Offer, or Marketplace when listed)
Ansible 2.16+ on a control host that can SSH to the instance
Role pin used in this post: v0.2.4-private-review — check stigready/ubuntu24-cis for newer tags

1. Launch Base

Watch the StigReady seller page for public listings, or contact us for early access to Ubuntu 24.04 Base (x86_64 or arm64).
Launch with a key pair you control.
SSH as ubuntu (or use SSM Session Manager).

ssh -i your-key.pem ubuntu@<instance-ip>

2. Install the role (pinned tag)

# requirements.yml
roles:
  - src: https://github.com/stigready/ubuntu24-cis
    scm: git
    version: v0.2.4-private-review
    name: ubuntu24_cis

ansible-galaxy role install -r requirements.yml -p ./roles

3. Run the playbook

# inventory.ini
[stig]
ubuntu24-base ansible_host=<instance-ip> ansible_user=ubuntu

# site.yml
- hosts: stig
  become: true
  roles:
    - role: ubuntu24_cis

ansible-playbook -i inventory.ini site.yml

The role default profile is cis-l1 (stigforge_profile in defaults/main.yml). CIS Level 2 OpenSCAP evidence for the same release is under compliance/releases/…/cis-l2/ — use that when your policy requires L2, and prefer Applied CIS L2 AMIs if you want L2 scored at bake without wiring it yourself.

4. Check published evidence

L1 evidence: compliance/releases/0.2.4-private-review/cis-l1
L2 evidence: …/cis-l2
Matrix scores: stigready.com/#stigforge
Re-prove: make prove RELEASE=0.2.4-private-review in the role repo

Questions? contact@stigready.com