Fedora Linux 44 Minimal on AWS User Guide

Overview

This guide covers launching and verifying the Fedora Linux 44 Minimal AMI from cloudimg on Amazon EC2. It is one version of the cloudimg community Linux listing on AWS Marketplace; you pick it as the software version when you subscribe and launch. Every distribution and version in the listing is described at /guides/community-linux-aws/.

Fedora Linux is the community distribution sponsored by Red Hat, where new kernel, systemd, toolchain and desktop technology arrives first. Fedora is not a long-term-support release. A new Fedora release ships about every six months (April and October), and each release is supported for about 13 months, until four weeks after the release two versions later. Fedora Linux 44 is supported until 19 May 2027 (the SUPPORT_END date in /etc/os-release); plan to move to a newer Fedora release before then (Step 13).

This image is built from Fedora's official Cloud Base image for Fedora 44 and adds four things:

• A trimmed package set. Fedora Cloud Edition's container stack (Podman and its networking and runtime packages, the cross-architecture emulators and their dependencies) and a few other packages a minimal server does not need are removed. Each removal is simulated first and refused if it would take a package the instance needs to boot, network or be reached. The list ships on the image.
• OSPP remediation. The image is remediated with the OpenSCAP OSPP (Protection Profile for General Purpose Operating Systems) profile from SCAP Security Guide 0.1.82 (Fedora's own signed scap-security-guide package), then rebooted and evaluated. Measured on a fresh instance of this AMI, 166 of 184 scored rules pass (90.2%). Six rules are waived because they cannot work on an EC2 image, each with its reason, and the rules that still fail are listed below with the reason for each. The HTML report, the machine-readable results, the waiver list and a summary ship in /usr/share/doc/cloudimg/. This is not a Common Criteria evaluation or NIAP certification of the image.
• EC2 defaults that keep you in control. Key-only SSH as fedora, root locked, no password on any account, SELinux enforcing, IMDSv2 required, a host firewall (firewalld) that drops unsolicited inbound traffic except SSH, the current AWS Systems Manager agent, and time from the Amazon Time Sync Service.
• Fully patched at build time, checked against Fedora's master update repository, with dnf-automatic applying security updates on your instance.

What is on the image: Fedora Linux 44 (Cloud Edition) with its Linux 7.2 kernel, cloud-init, OpenSSH, firewalld, chrony, SELinux (targeted policy, enforcing), the AWS Systems Manager agent, the AWS CLI (Fedora's awscli2 package), auditd, fapolicyd (installed, not enabled), dnf-automatic, OpenSCAP and the pinned SCAP Security Guide content used for the evaluation.

Default user: fedora · Architecture: x86_64 · Root volume: 5 GiB gp3, btrfs (grows to the size you choose at launch)

Connecting to your instance

Version	SSH user	Root device
Fedora Linux 44 Minimal	fedora	/dev/sda1 (5 GiB gp3)

Security posture

• No known credential. There is no default password and no baked in SSH key. The only key that works is the EC2 key pair you choose at launch, which cloud-init installs for fedora on first boot.
• Key-only SSH. PasswordAuthentication no, PermitRootLogin no, keyboard-interactive off. The root account has no password and is locked.
• Per-instance identity. SSH host keys and the machine ID are generated fresh on every instance, so no two instances share a host key.
• IMDSv2 required. The AMI is registered with ImdsSupport v2.0, so instances launched from it refuse token-less (IMDSv1) metadata requests by default.
• SELinux enforcing with the targeted policy, as Fedora ships it.
• Host firewall. firewalld's default zone is drop: unsolicited inbound traffic is dropped, except SSH and the replies to the instance's IPv6 DHCP client. All outbound traffic is allowed, so the SSM agent, metadata service, DNS, time and package updates keep working.
• Only SSH listens on the network. The system resolver listens on loopback only; its LLMNR and multicast DNS responders are switched off.
• No build residue. The image was copied file by file onto a fresh volume after the build, so no deleted build file survives in its free space.

Prerequisites

1. An AWS account and permission to launch EC2 instances
2. An EC2 key pair in the Region you launch in
3. A security group that allows TCP 22 from your own address (not from the whole internet)

Recommended instance type: m5.large. The image runs on any current x86_64 instance type.

Step 1: Launch the instance

Option A: AWS Marketplace console

1. Open the cloudimg community Linux listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Once the subscription is active, choose Launch your software.
3. Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for full control), then in Version choose Fedora Linux 44 Minimal - YYYY-MM-DD (the date is when the version was added) and your Region.
4. Instance type: m5.large is recommended; any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
5. Key pair: choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.
6. Security group: allow inbound TCP 22 from your own IP address or network only.
7. Storage: the root volume is 5 GiB gp3 by default. Choose a larger size if you need one; cloud-init grows the root partition and filesystem to fill it on first boot.
8. Metadata: leave the defaults. The image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and the key pair, security group and subnet with your own. The root device of this AMI is /dev/sda1:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=fedora-44-minimal}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

Step 2: Connect via SSH

From your workstation, connect as fedora with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem fedora@<public-ip>

There is no password to enter. Before the prompt you see the login banner (Step 11). If SSH asks for a password, see Troubleshooting below.

You can also connect without opening port 22 at all through AWS Systems Manager Session Manager, if the instance has an instance profile that allows Systems Manager. The agent is installed and running on this image.

Idle shell sessions are closed after 10 minutes (TMOUT=600, an OSPP requirement). Use screen (installed, an OSPP requirement) or tmux (sudo dnf -y install tmux) for long-running interactive work.

Step 3: Confirm the release

cat /etc/fedora-release
grep -E '^(NAME|VERSION|ID|VERSION_ID|VARIANT_ID|SUPPORT_END)=' /etc/os-release
uname -srm

Expected output:

Fedora release 44 (Forty Four)
NAME="Fedora Linux"
VERSION="44 (Cloud Edition)"
ID=fedora
VERSION_ID=44
SUPPORT_END=2027-05-19
VARIANT_ID=cloud
Linux 7.2.11-200.fc44.x86_64 x86_64

SUPPORT_END is the date Fedora stops publishing updates for release 44. Your kernel version may be newer if updates have installed since this image was built.

Step 4: See what the Minimal trim removed

The image lists exactly what was removed, and anything that a removal would have taken with it is kept and listed instead:

cat /usr/share/doc/cloudimg/minimal-manifest.txt
rpm -qa | wc -l

Expected output:

Minimal version: packages 526 -> 457
Removed:
  podman
  python3-dnf-plugin-tracer
  console-login-helper-messages
  gawk-all-langpacks
  prefixdevname
  rsync
Kept (a removal would have taken a protected package, or it failed):
478

The trim takes the package count from 526 to 457. Removing podman takes Fedora Cloud's whole container stack with it (the container runtimes, networking helpers and the cross-architecture qemu-user-static emulators). Nothing had to be kept back. After the trim, the OSPP remediation adds the tools it needs (OpenSCAP, fapolicyd, rng-tools and their libraries), so a new instance has 478 packages. The count on your instance moves by a few as updates install.

Anything removed is one sudo dnf install away from the standard Fedora repositories (for example sudo dnf -y install podman; see Step 12 for the one setting rootless containers need).

Step 5: Read the compliance evidence

The evaluation ships on the image:

ls -lh /usr/share/doc/cloudimg/
python3 -c "import json; s=json.load(open('/usr/share/doc/cloudimg/ospp-summary.json')); print('profile:      ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived:       ', s['waived'], ' not applicable:', s['notapplicable'])"

Expected output:

total 33M
-rw-r--r--. 1 root root  229 Oct 20 11:43 minimal-manifest.txt
-rw-r--r--. 1 root root  30M Oct 20 11:51 ospp-arf.xml
-rw-r--r--. 1 root root 3.2M Oct 20 11:51 ospp-report.html
-rw-r--r--. 1 root root 2.1K Oct 20 11:51 ospp-summary.json
-rw-r--r--. 1 root root 1.7K Oct 20 11:51 ospp-tailoring.xml
-rw-r--r--. 1 root root 2.5K Oct 20 11:51 ospp-waivers.txt
-rw-r--r--. 1 root root 1.6K Oct 20 11:44 scap-security-guide-LICENSE.txt
profile:       OSPP (General Purpose Operating Systems) (SCAP Security Guide 0.1.82)
scored rules:  184  pass: 166  fail: 18  rate: 90.2%
waived:        6  not applicable: 17

The report files on the image are the build's own evaluation; the same evaluation on a fresh instance of this AMI scored the same 166 of 184. Re-run it on your instance at any time (Step 6).

• ospp-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• ospp-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• ospp-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not selected, or waived are not counted.

To copy the report to your workstation, run this on the workstation:

scp -i ~/.ssh/my-key-pair.pem fedora@<public-ip>:/usr/share/doc/cloudimg/ospp-report.html .

Why OSPP, and not CIS

SCAP Security Guide 0.1.82 publishes CIS profiles for Fedora only as drafts (their titles begin "DRAFT"), so this image does not claim CIS alignment. It uses the published OSPP profile, the OpenSCAP mapping of the Protection Profile for General Purpose Operating Systems. The profile is applied and measured; the image has not been through a Common Criteria evaluation.

The six waived rules

grep -v '^#' /usr/share/doc/cloudimg/ospp-waivers.txt | cut -f1,2

Expected output:

grub2_password  [serial-console-and-boot]
grub2_uefi_password [serial-console-and-boot]
enable_fips_mode    [fips]
configure_crypto_policy [fips]
rsyslog_remote_loghost  [syslog-remote-placeholder]
auditd_audispd_configure_remote_server  [audit-remote-destination]

The full reason for each is the third column of the same file. In short:

• Boot loader passwords: a GRUB password would have to be baked into the image, giving every instance the same secret. Set your own if you need it.
• FIPS mode and the FIPS crypto policy: FIPS mode is a separate claim that needs validated modules, and Fedora's crypto modules are not FIPS-validated. The FIPS policy would also refuse ED25519 SSH keys, which EC2 key pairs may use. The system crypto policy stays at Fedora's DEFAULT.
• Remote log and audit servers: the content would point logs and audit records at a placeholder host called logcollector. An image cannot know your log server. Logs stay on the instance (the systemd journal and /var/log/audit).

The 18 rules that do not pass

python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/cloudimg/ospp-summary.json'))['failingRules']]"

Expected output:

audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat
audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write
audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order
audit_rules_unsuccessful_file_modification_open_o_creat
audit_rules_unsuccessful_file_modification_open_o_trunc_write
audit_rules_unsuccessful_file_modification_open_rule_order
audit_rules_unsuccessful_file_modification_openat_o_creat
audit_rules_unsuccessful_file_modification_openat_o_trunc_write
audit_rules_unsuccessful_file_modification_openat_rule_order
chronyd_configure_local_socket
ensure_fedora_gpgkey_installed
installed_OS_is_vendor_supported
package_dnf-automatic_installed
selinux_all_devicefiles_labeled
selinux_confinement_of_daemons
sysctl_kernel_core_pattern
sysctl_kernel_yama_ptrace_scope
timer_dnf-automatic_enabled

Each one is a limit of the Fedora content in SCAP Security Guide 0.1.82 or a deliberate choice, not a setting the image left undone:

• The nine audit_rules_unsuccessful_file_modification_* rules. Failed file creation and truncation attempts are audited: the remediation installs rules for creat, open, openat, open_by_handle_at, truncate and ftruncate failing with EACCES or EPERM (/etc/audit/rules.d/access.rules). The checks expect a different layout of the same events, split by the O_CREAT and O_TRUNC flags and in a set order, which the Fedora fix does not write.
• chronyd_configure_local_socket. The profile closes chrony's network command port (cmdport 0, applied). The check also wants the chrony-wait.service unit rewritten to use chrony's local socket; that unit is not enabled on this image.
• ensure_fedora_gpgkey_installed. Fedora's 44 signing key is installed and every repository and package is signature-checked (the gpgcheck rules pass). The check only knows Fedora's keys up to release 40.
• installed_OS_is_vendor_supported. The check recognises commercially supported distributions only. Fedora is supported by the Fedora Project until 19 May 2027.
• package_dnf-automatic_installed and timer_dnf-automatic_enabled. Automatic updates are installed and on: Fedora 44's dnf5-plugin-automatic provides dnf-automatic, and its dnf5-automatic.timer is enabled (Step 10). The checks look for the DNF 4 package name and timer, which Fedora 44 no longer uses.
• selinux_all_devicefiles_labeled and selinux_confinement_of_daemons. Both fail because the AWS Systems Manager agent runs unconfined (unconfined_service_t): Amazon ships the agent without an SELinux policy module. Every other daemon runs in its own SELinux domain. If you do not use Systems Manager, sudo systemctl disable --now amazon-ssm-agent clears both.
• sysctl_kernel_core_pattern and sysctl_kernel_yama_ptrace_scope. Both settings are in force (kernel.core_pattern = |/bin/false, kernel.yama.ptrace_scope = 1, set in /etc/sysctl.conf, which takes precedence at boot). The checks also require Fedora's own defaults in /usr/lib/sysctl.d/ to agree, and editing packaged files there would break package verification and be undone by the next update.

Step 6: Re-run the evaluation yourself

You can repeat the evaluation at any time with the same content and tailoring. It takes about a minute:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/cloudimg/ospp-tailoring.xml \
  --profile xccdf_co.cloudimg_profile_ospp_ec2_single \
  --results /tmp/ospp-check-results.xml --report /tmp/ospp-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml > /tmp/ospp-check.log 2>&1
echo "oscap exit code: $? (2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/ospp-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print('pass', c['pass'], 'fail', c['fail'], 'of', s, '= %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 2 (2 = at least one rule did not pass)
pass 166 fail 18 of 184 = 90.2%

Your own report is at /tmp/ospp-check-report.html. As you install software and change settings, re-run this to see how your changes affect the result.

Step 7: Confirm IMDSv2 is required

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401
us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2; every current AWS SDK and the AWS CLI do this automatically.

Step 8: The host firewall and listening ports

sudo firewall-cmd --state
sudo firewall-cmd --list-all
sudo ss -tlnp

Expected output:

running
drop (default, active)
  target: DROP
  ingress-priority: 0
  egress-priority: 0
  icmp-block-inversion: no
  interfaces: ens5
  sources: 
  services: dhcpv6-client ssh
  ports: 
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess                                   
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*    users:(("sshd",pid=837,fd=6))            
LISTEN 0      4096   127.0.0.53%lo:53        0.0.0.0:*    users:(("systemd-resolve",pid=488,fd=15))
LISTEN 0      4096      127.0.0.54:53        0.0.0.0:*    users:(("systemd-resolve",pid=488,fd=17))
LISTEN 0      128             [::]:22           [::]:*    users:(("sshd",pid=837,fd=7))            

• sshd is the only service listening on a network address, on port 22. systemd-resolved listens on loopback only (127.0.0.53 and 127.0.0.54).
• The drop zone silently drops any inbound connection that is not SSH or a DHCPv6 reply. Replies to connections the instance makes itself are always allowed.

Opening a port for your own service takes two steps: allow it in the instance's security group, and allow it in firewalld. For example, for a web server on 443, run on the instance:

sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld (or the other way round), the traffic will not arrive. Because the zone is drop, a blocked connection times out rather than being refused.

Step 9: Time sync and the Systems Manager agent

systemctl is-active chronyd amazon-ssm-agent
sudo chronyc -n sources

Expected output (the pool servers and timings vary):

active
active
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^- 198.137.202.56                2   6   377     7   -263us[ -263us] +/-   36ms
^- 67.215.249.229                2   6   377    10   +566us[ +590us] +/-   17ms
^- 144.202.41.38                 2   6   377     9   +897us[ +920us] +/-   30ms
^- 134.215.155.177               2   6   377     8   +530us[ +554us] +/-   25ms
^* 169.254.169.123               3   4   377     7   -636ns[  +23us] +/-  551us

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public Fedora pool servers are fallbacks. chronyc needs sudo because chrony's network command port is closed (cmdport 0); it talks to chronyd through its local socket instead.

The AWS Systems Manager agent is installed from Amazon's own package at its current release (3.3.5390.0 on this build). It is not in the Fedora repositories, so dnf does not update it; Systems Manager can keep it current for you (the AWS-UpdateSSMAgent document, or the Auto update SSM Agent setting in Fleet Manager).

Step 10: Patch level and automatic updates

The image is fully patched at build time. Check what is pending now:

sudo dnf -q check-update --refresh > /dev/null
echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)"
grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf
systemctl is-enabled dnf5-automatic.timer

Expected output on an instance launched soon after the image was built (later launches list exit code 100 for the updates released since):

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available)
apply_updates = yes
upgrade_type = security
enabled

dnf-automatic (DNF 5's automatic plugin) runs daily at 06:00, with a random delay of up to an hour, and installs the updates Fedora marks as security updates. Fedora publishes security advisories for each update, so upgrade_type = security installs real security fixes. Fedora also ships frequent bug-fix and feature updates; to install everything now, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

Step 11: Security settings on the instance

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|banner) '
head -3 /etc/issue

Expected output:

Enforcing
root L 2026-10-19 -1 -1 -1 -1
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
banner /etc/issue
-- WARNING -- This system is for the use of authorized users only. Individuals
using this computer system without authority or in excess of their authority
are subject to having all their activities on this system monitored and

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on; if your own software is denied, check sudo ausearch -m avc -ts recent rather than disabling SELinux.
• L means the root account is locked.
• The banner is the OSPP profile's standard notice, shown before login. Replace /etc/issue with your own organisation's text if you prefer.
• Other OSPP settings in force include audit rules for privileged commands and permission changes, failed-login lockout (pam_faillock), password quality rules for any password you set, kernel hardening boot options (pti=on, vsyscall=none, page_poison=1, slub_debug=P, audit=1) and kernel modules such as atm, can, tipc and firewire-core blocked.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. If you want serial console access, set a password for your own user on your running instance (the password is yours and is not on the image):

sudo passwd fedora

Step 12: Disk, swap and user namespaces

df -hT /
sudo btrfs subvolume list /
swapon --show
cat /proc/sys/user/max_user_namespaces

Expected output with the default 5 GiB root volume:

Filesystem     Type   Size  Used Avail Use% Mounted on
/dev/nvme0n1p3 btrfs  4.9G  2.1G  2.5G  47% /
ID 256 gen 25 top level 5 path root
ID 257 gen 20 top level 5 path boot
ID 258 gen 20 top level 5 path home
ID 259 gen 34 top level 5 path var
NAME       TYPE      SIZE  USED PRIO
/dev/zram0 partition 3.7G 35.9M  100
0

• Disk layout. As on Fedora Cloud, one btrfs partition holds the subvolumes root (mounted at /), boot, home and var, mounted with compress=zstd:1, so new data is compressed transparently. The EFI system partition is mounted at /boot/efi.
• Disk growth. cloud-init grows the root partition and filesystem to the volume size on first boot. To grow later, increase the EBS volume size in the console or with aws ec2 modify-volume, then run sudo growpart /dev/nvme0n1 3 && sudo btrfs filesystem resize max / (or reboot).
• Swap. Fedora's default compressed swap in RAM (zram0, sized from the instance's memory). There is no swap on disk.
• User namespaces are off (user.max_user_namespaces = 0, an OSPP setting). Rootless containers (Podman, Toolbx) and some sandboxed programs need them. If you install Podman for rootless use, allow them again on your instance:

echo 'user.max_user_namespaces = 15000' | sudo tee /etc/sysctl.d/90-user-namespaces.conf
sudo sysctl --system

Step 13: Install software, add users and upgrade Fedora

The instance uses the standard Fedora 44 repositories (fedora and updates):

sudo dnf -q list --available nginx

Expected output (the version changes over time):

Available packages
nginx.x86_64 2:1.30.5-1.fc44 updates

Install and start software in the usual way, for example sudo dnf -y install nginx then sudo systemctl enable --now nginx, and open its port in the security group and firewalld (Step 8).

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh
echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys (and restorecon gives the file the SELinux label sshd expects). The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice. SSH stays key-only; the password is used by sudo.

Moving to the next Fedora release. Fedora releases are upgraded in place with the system-upgrade plugin. Take a snapshot of the EBS volume first, then (for example, to Fedora 45 once it is released):

sudo dnf -y upgrade --refresh
sudo dnf system-upgrade download --releasever=45
sudo dnf offline reboot

The cloudimg hardening settings are ordinary configuration files and carry over; re-run Step 6 afterwards. cloudimg also publishes images for newer Fedora releases as they are added to the listing.

Common use cases

• A small, current Linux for workloads that want the newest kernel, compilers and language runtimes, with SELinux enforcing from the first boot
• Development and CI hosts that should track upstream closely, rebuilt or upgraded each Fedora release
• A base for workloads that must show an OSPP-aligned configuration, with the evaluation report already on the machine
• Fleets managed through Systems Manager, with IMDSv2 required from the first boot
• A starting point for your own golden image: add your software, re-run Step 6, and keep the report with your build

Troubleshooting

Cannot connect via SSH

1. Check the instance is running and has passed its status checks.
2. Check the security group allows TCP 22 from your current public address.
3. Use the user name fedora (not ec2-user) and the key pair chosen at launch. Password login is disabled, so a wrong key never falls back to a password prompt.
4. If you changed firewalld, make sure the ssh service is still allowed in the drop zone. Session Manager (Step 2) still works if SSH is blocked, provided the instance has a Systems Manager instance profile.

My SSH session closes when I leave it idle

The OSPP profile sets a 10-minute idle timeout for shells (TMOUT=600 in /etc/profile.d/). Run long jobs under tmux, screen or nohup.

My service is running but not reachable

Allow the port in both the security group and firewalld (Step 8). sudo firewall-cmd --list-all shows the firewalld rules; sudo ss -tlnp shows whether the service listens on all addresses or only on loopback. If the service runs on a non-standard port, SELinux may also need to allow it, for example sudo semanage port -a -t http_port_t -p tcp 8080 for a web server on 8080 (semanage is in the policycoreutils-python-utils package).

A tool that uses instance metadata fails

The image requires IMDSv2. Old scripts that call http://169.254.169.254/ without a token get HTTP 401. Update them to request a token first (Step 7), or use the AWS CLI or a current SDK.

Package manager issues

Refresh the metadata first:

sudo dnf -q makecache --refresh && echo "repository metadata refreshed"

If the repositories are unreachable, check that the instance has outbound internet access (a public IP or a NAT gateway) and that DNS resolves:

getent hosts mirrors.fedoraproject.org > /dev/null && echo "mirrors.fedoraproject.org resolves"

Important notes

Fedora Linux is free and open source software. It is a distribution of thousands of packages, each under its own licence (GPL, LGPL, MIT, BSD, Apache 2.0 and others); rpm -qi <package> shows each package's licence. No subscription or licence key is needed to run this image. The compliance tooling is OpenSCAP (LGPL 2.1 or later) and SCAP Security Guide content (BSD 3-Clause, licence text in /usr/share/doc/cloudimg/scap-security-guide-LICENSE.txt).

Fedora Linux 44 is maintained by the Fedora Project until 19 May 2027. Fedora is not a long-term-support distribution: new releases arrive about every six months and each is supported for about 13 months.

The OSPP profile used here is the OpenSCAP profile published in SCAP Security Guide. A pass rate measures this image as built; it is not a Common Criteria evaluation or NIAP certification, and your own changes affect it, which is why the evaluation can be re-run (Step 6).

Fedora is a trademark of Red Hat, Inc. These names are used only to identify the software. cloudimg is not affiliated with or endorsed by the Fedora Project or Red Hat.

Support

For help with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• User Guides: www.cloudimg.co.uk/guides
• Community Linux on AWS hub: www.cloudimg.co.uk/guides/community-linux-aws