Security AWS

OpenSCAP SCAP Compliance Scanner on AWS User Guide

Last updated: 2026-07-21 | Product: OpenSCAP on AWS

Overview

This image runs OpenSCAP, the reference open source implementation of the Security Content Automation Protocol (SCAP). OpenSCAP parses a SCAP datastream, evaluates the policy rules against the live state of the system, and produces both a human-readable HTML report and a machine-readable ARF (Asset Reporting Format) results file. This AMI pairs the oscap scanner with the upstream SCAP Security Guide content, so the appliance can audit the operating system it runs on against real CIS and DISA STIG benchmarks the moment it boots.

It is important to be precise about what this image is. OpenSCAP is a compliance scanner, not a compliance suite. It measures and reports: it tells you where a machine stands against a chosen policy profile and gives you evidence you can keep. It has no web console, no fleet inventory, and no historical dashboard, and it never makes a machine compliant on its own. For a single-node audit and drift-detection appliance, and as a legitimate generator of CIS and STIG evidence, that is exactly the useful shape.

The image ships with no login and no credential of any kind. OpenSCAP has no web interface, no daemon, and no user database; you operate it entirely from the command line over SSH with your own key. There is nothing to rotate and nothing to leak.

The image is fail-closed by design. For a compliance product the worst possible outcome is a confident wrong answer, so the appliance verifies the integrity of its policy content before every scheduled scan (the datastream must be present, unaltered against its recorded checksum, and accepted by the scanner), and a failed first boot stops the scheduled scan rather than reporting a clean result from missing content.

Prerequisites

Before you deploy this image you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from the networks you administer from
The AWS CLI version 2 installed locally if you plan to deploy from the command line

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for OpenSCAP. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Pick an instance type of m5.large or larger as a balanced default. A full CIS evaluation parses a large datastream into memory and runs many checks, so give the instance at least 4 GB of RAM. Choose your EC2 key pair under Key pair (login). Under Network settings select your VPC and subnet, and either create or select a security group that allows inbound port 22 from the networks you administer from. OpenSCAP binds no network port of its own, so only port 22 is required.

Select Launch instance. On first boot the appliance runs a baseline compliance scan of the instance automatically; this takes a couple of minutes after the instance state becomes Running and the status checks pass.

Step 2: Launch the Instance from the AWS CLI

The following block launches an instance from the cloudimg OpenSCAP Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens port 22 from the networks you administer from.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}' \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=openscap}]'

Step 3: Connect to Your Instance over SSH

Connect to the instance with SSH as the default login user for the operating system variant you launched. Replace the key path and instance address with your own.

ssh -i /path/to/your-key.pem <login-user>@<vm-ip>

The login user differs by variant:

Operating system variant	SSH login user
Ubuntu 24.04 LTS	`ubuntu`

Step 4: Read the First-Boot Baseline Summary

On the first boot of every deployed instance, the appliance runs a baseline compliance scan and writes a short summary to a root-only note. Read it to confirm the scan ran and to see the headline pass and fail counts for this instance:

sudo cat /root/openscap-instance.txt

A CIS scan of a general-purpose server image is expected to report failures. The report tells you what a hardening programme would need to address; it does not mean anything is wrong with the instance. The full baseline HTML report and ARF results are written under /var/lib/cloudimg/openscap/reports/.

Step 5: Confirm the Scanner and Its Version

Check the installed scanner and the SCAP specifications it supports:

oscap --version

Step 6: List the Available Compliance Profiles

The image ships the upstream SCAP Security Guide content with the full set of profiles for this operating system. List every profile you can scan against:

oscap info --profiles /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

You will see the CIS Level 1 and Level 2 benchmarks for both server and workstation, and the DISA STIG profile. The default profile the appliance audits against is xccdf_org.ssgproject.content_profile_cis_level1_server, which is the right default for a general-purpose server.

Step 7: Run an On-Demand Scan

Run a compliance evaluation on demand against any shipped profile. The block below evaluates the CIS Level 1 Server profile, writes a timestamped HTML report and ARF results into a temporary directory, prints the pass and fail counts, and then cleans up. On an unhardened image oscap exits with code 2 when one or more rules do not pass, which is the correct and expected outcome, so the evaluation is run tolerantly here and the results file is inspected for substance:

DS=/usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml
WORK=$(mktemp -d)
sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --results "$WORK/results.xml" \
  --report "$WORK/report.html" \
  "$DS" > "$WORK/eval.log" 2>&1 || true
PASS=$(grep -c '<result>pass</result>' "$WORK/results.xml" 2>/dev/null || echo 0)
NONCONFORMANT=$(grep -c '<result>fail</result>' "$WORK/results.xml" 2>/dev/null || echo 0)
echo "rule results: pass=$PASS nonconformant=$NONCONFORMANT"
ls -l "$WORK/report.html" "$WORK/results.xml"
sudo rm -rf "$WORK"
echo "on-demand scan complete"

To keep a report, point --report and --results at a durable path such as /var/lib/cloudimg/openscap/reports/ and download the HTML file with scp to review it in a browser.

Step 8: Scheduled Drift Detection

The image ships a systemd timer that re-runs your chosen profile on a schedule and keeps the most recent dated reports, so you can track how the instance's compliance posture drifts over time. Inspect the timer:

systemctl list-timers openscap-scan.timer --no-pager

The scheduled scan is audit only and never applies a fix. To change the profile it evaluates or how many reports it retains, edit the scan configuration and restart is not required (the next run picks up the change):

sudo nano /etc/cloudimg/openscap-scan.conf

The configuration sets SCAN_PROFILE, SCAN_ENABLED (set to no to make the scheduled scan a no-op without touching systemd), and SCAN_KEEP_REPORTS. Reports are written to /var/lib/cloudimg/openscap/reports/.

Step 9: Scan Remote Hosts over SSH

Using oscap-ssh and your own SSH key, one appliance can evaluate other Linux hosts over the network from this instance. All remote scanning is outbound — nothing listens on this instance. Replace the target user, host, and port with your own; the target must have the openscap-scanner package and a matching datastream available, or you can push the local content. The block below is illustrative and is not run automatically because it connects to a host you provide:

oscap-ssh <remote-user>@<remote-host> 22 \
  xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --report /tmp/remote-report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

Step 10: Generate Remediation for Review

When a scan reports failures, OpenSCAP can generate remediation scoped to your own results. Remediation is destructive — CIS Level 2 and STIG hardening can disable services, tighten the SSH daemon, and lock an instance down, so it must always be reviewed before it is applied. This image never applies a fix automatically. Generate a remediation script from a results file for review like this (illustrative, not run automatically):

sudo oscap xccdf generate fix \
  --fix-type bash \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --output /tmp/remediation.sh \
  /var/lib/cloudimg/openscap/reports/openscap-baseline-<timestamp>.xml

The upstream remediation scripts and Ansible playbooks for every shipped profile are installed for reference under /usr/share/cloudimg/openscap/remediation/ (non-executable by design). Review any remediation carefully, test it on a non-production instance, and apply it deliberately.

Step 11: Upgrade the SCAP Security Guide Content

The SCAP policy content is a version-pinned upstream release. A newer SCAP Security Guide release adds and updates rules; because the content is declarative XML policy rather than executable code, upgrading it is a compliance-currency choice you make, not a security patch. To move to a newer release, download the prebuilt content archive from the ComplianceAsCode project, verify it against its published checksum, and replace the datastream at /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml, then update the recorded checksum manifest at /usr/share/cloudimg/openscap/datastream.sha256 so the fail-closed preflight accepts the new content (illustrative, not run automatically):

VER=<new-version>
cd /var/tmp
curl -fLO https://github.com/ComplianceAsCode/content/releases/download/v${VER}/scap-security-guide-${VER}.tar.gz
curl -fLO https://github.com/ComplianceAsCode/content/releases/download/v${VER}/scap-security-guide-${VER}.tar.gz.sha512
sha512sum -c scap-security-guide-${VER}.tar.gz.sha512
tar -xzf scap-security-guide-${VER}.tar.gz scap-security-guide-${VER}/ssg-ubuntu2404-ds.xml
sudo install -m 0644 scap-security-guide-${VER}/ssg-ubuntu2404-ds.xml /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml
sudo sha256sum /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml | awk '{print $1}' | sudo tee /usr/share/cloudimg/openscap/datastream.sha256

Patching and Updates

The OpenSCAP scanner is installed from the Ubuntu archive and is kept current by the operating system's standard unattended-upgrades, so the only executable attack surface on the appliance receives security updates automatically. The SCAP content is managed with the one-command upgrade above. The appliance itself introduces no listening network service.

Support

cloudimg provides 24/7 technical support for this product by email at support@cloudimg.co.uk and by live chat. We can help with profile selection, scheduled scanning, scanning remote hosts, reviewing generated remediation, and upgrading the SCAP Security Guide content.

OpenSCAP and the SCAP Security Guide are projects of Red Hat, Inc. and their contributors. Their names are used here nominatively to identify the software this image packages; cloudimg is not affiliated with, endorsed by, or sponsored by Red Hat, Inc. or the ComplianceAsCode project. CIS and DISA STIG are the marks of the Center for Internet Security and the US Defense Information Systems Agency respectively; the profiles on this image are the ComplianceAsCode community implementations of those benchmarks and a passing scan is not a certification of compliance.