Rocky Linux 8.10 on AWS User Guide

Overview

This guide covers launching and verifying the Rocky Linux 8.10 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg Rocky Linux listing on AWS Marketplace; you pick it as the software version when you subscribe and launch. Every release and variant in the listing is described at /guides/rocky-linux-aws/.

Rocky Linux 8 is a free, community-built enterprise Linux distribution that is binary compatible with Red Hat Enterprise Linux 8, supported until 31 May 2029. Version 8.10, codename Green Obsidian, is the final point release of Rocky Linux 8: there will be no 8.11, so every Rocky Linux 8 update from now until end of life is an 8.10 update. This image is that point release: the build checks the release before it changes anything and refuses to run on any other, so an instance launched from it reports Rocky Linux 8.10. It adds four things:

• The exact point release, fully patched. Every Rocky Linux 8.10 update published before the build date is installed. Step 4 explains how updates behave after launch.
• CIS Level 1 Server remediation. The image is remediated with the OpenSCAP CIS Level 1 Server profile from SCAP Security Guide 0.1.82 (Rocky Linux's own signed scap-security-guide package and its ssg-rl8 content), then rebooted and evaluated. On this build all 294 scored rules pass (100.0%), measured again on a fresh instance launched from the finished image. Eight rules are waived because they cannot work on a single-volume EC2 image, each with its reason. The HTML report, the machine-readable results, the waiver list and a summary ship in /usr/share/doc/cloudimg/.
• EC2 defaults that keep you in control. Key-only SSH as rocky, root locked, no password on any account, SELinux enforcing, IMDSv2 required, a host firewall (firewalld) that allows SSH in and everything out, the Cockpit web console installed but switched off, the current AWS Systems Manager agent, and time from the Amazon Time Sync Service.
• Automatic security updates on your instance with dnf-automatic.

What is on the image: Rocky Linux 8.10 (the RHEL 8 compatible 4.18 kernel) with the standard Rocky Linux package set, cloud-init, OpenSSH, firewalld, chrony, SELinux (targeted policy, enforcing), the AWS Systems Manager agent, auditd, rsyslog, AIDE file integrity checking, dnf-automatic, the kdump crash-dump service, Python 3.6, the Cockpit web console (disabled), OpenSCAP and the pinned SCAP Security Guide content used for the evaluation.

Default user: rocky · Architecture: x86_64 · Boot mode: UEFI preferred (legacy BIOS on instance types without UEFI) · Root volume: 11 GiB gp3, XFS (grows to the size you choose at launch)

These images are remediated with an OpenSCAP profile and ship their own evaluation report. They are not CIS Hardened Images, and CIS has not reviewed or certified them.

Connecting to your instance

Version	SSH user	Root device
Rocky Linux 8.10	rocky	/dev/sda1 (11 GiB gp3)

Security posture

• No known credential. There is no default password and no baked in SSH key. The only key that works is the EC2 key pair you choose at launch, which cloud-init installs for rocky on first boot. The SSH server has no other way to look up keys (no AuthorizedKeysCommand).
• Key-only SSH. PasswordAuthentication no, PermitRootLogin no, keyboard-interactive and challenge-response off. The root account has no password and is locked.
• Per-instance identity. SSH host keys, the machine ID and the host name are generated fresh on every instance, so no two instances share a host key.
• IMDSv2 required. The AMI is registered with ImdsSupport v2.0, so instances launched from it refuse token-less (IMDSv1) metadata requests by default.
• SELinux enforcing with the targeted policy, as Rocky Linux ships it.
• Host firewall. firewalld's public zone allows only SSH and the DHCPv6 client inbound and allows all outbound traffic, so the SSM agent, metadata service, DNS, time and package updates keep working.
• Only SSH listens on the network. The Cockpit web console (port 9090) is installed, as in a standard Rocky Linux system, but its socket is switched off and a preset keeps it off, so nothing but sshd listens on a TCP port. Step 8 shows how to turn Cockpit on if you want it.

Prerequisites

1. An AWS account and permission to launch EC2 instances
2. An EC2 key pair in the Region you launch in
3. A security group that allows TCP 22 from your own address (not from the whole internet)

Recommended instance type: m5.large. The image runs on any current x86_64 instance type.

Step 1: Launch the instance

Option A: AWS Marketplace console

1. Open the cloudimg Rocky Linux listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Once the subscription is active, choose Launch your software.
3. Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for full control), then in Version choose Rocky Linux 8.10 - YYYY-MM-DD HH:MM (the UTC date and time the version was added) and your Region.
4. Instance type: m5.large is recommended; any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
5. Key pair: choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.
6. Security group: allow inbound TCP 22 from your own IP address or network only.
7. Storage: the root volume is 11 GiB gp3 by default. Choose a larger size if you need one; cloud-init grows the root partition and filesystem to fill it on first boot.
8. Metadata: leave the defaults. The image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and the key pair, security group and subnet with your own. The root device of this AMI is /dev/sda1:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rocky-linux-8-10}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

Step 2: Connect via SSH

From your workstation, connect as rocky with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem rocky@<public-ip>

There is no password to enter. If SSH asks for one, or says Too many authentication failures, see Troubleshooting below.

You can also connect without opening port 22 at all through AWS Systems Manager Session Manager, if the instance has an instance profile that allows Systems Manager. The agent is installed and running on this image.

Step 3: Confirm the release

cat /etc/rocky-release
grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release
uname -srm

Expected output:

Rocky Linux release 8.10 (Green Obsidian)
NAME="Rocky Linux"
VERSION="8.10 (Green Obsidian)"
ID="rocky"
VERSION_ID="8.10"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Rocky Linux 8.10 (Green Obsidian)"
Linux 4.18.0-553.176.1.el8_10.x86_64 x86_64

Your kernel version may be newer if updates have installed since this image was built.

Step 4: The final point release and how updates behave

This version is named for, and built from, Rocky Linux 8.10. The listing also carries Rocky Linux 8 versions (Rocky Linux 8 Minimal and Rocky Linux 8 LVM) that are rebuilt from the current Rocky Linux 8 release. Choose this one when your build sheet, compliance baseline or vendor support matrix names 8.10 and you want the standard Rocky Linux package set.

The instance uses the standard Rocky Linux 8 repositories:

rpm -q rocky-release
dnf -q repolist
grep -E '^(SUPPORT_END|ROCKY_SUPPORT_PRODUCT_VERSION)=' /etc/os-release

Expected output:

rocky-release-8.10-1.14.el8.noarch
repo id                         repo name
appstream                       Rocky Linux 8 - AppStream
baseos                          Rocky Linux 8 - BaseOS
extras                          Rocky Linux 8 - Extras
SUPPORT_END="2029-05-31"
ROCKY_SUPPORT_PRODUCT_VERSION="8.10"

How updates behave. Rocky Linux maintains only the newest point release of each major version, and for Rocky Linux 8 that is 8.10 for the rest of its life:

• sudo dnf upgrade and the automatic security updates (Step 10) install Rocky Linux 8 updates, and the instance stays on 8.10. There is no later Rocky Linux 8 point release for it to move to, so you do not need to hold the release (no releasever setting) to keep an instance on 8.10.
• The rocky-release package itself is updated from time to time (its release number above changes), but the version it reports stays 8.10.
• Security updates continue until Rocky Linux 8 reaches end of life on 31 May 2029 (the SUPPORT_END above). After that date the repositories receive no further fixes. Plan the move to Rocky Linux 9 or 10, which this listing also carries, well before then.

Step 5: Read the compliance evidence

The evaluation the build ran after its reboot ships on the image:

ls -lh /usr/share/doc/cloudimg/
python3 -c "import json; s=json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json')); print('profile:      ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived:       ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 40M
-rw-r--r--. 1 root root  37M Oct 21 13:58 cis-l1-arf.xml
-rw-r--r--. 1 root root 2.5M Oct 21 13:58 cis-l1-report.html
-rw-r--r--. 1 root root 1.2K Oct 21 13:58 cis-l1-summary.json
-rw-r--r--. 1 root root 2.0K Oct 21 13:58 cis-l1-tailoring.xml
-rw-r--r--. 1 root root 3.2K Oct 21 13:58 cis-l1-waivers.txt
-rw-r--r--. 1 root root 1.6K Oct 21 13:51 scap-security-guide-LICENSE.txt
profile:       CIS Level 1 Server (SCAP Security Guide 0.1.82)
scored rules:  294  pass: 294  fail: 0  rate: 100.0%
waived:        8  not applicable: 38
evaluated at:  2026-10-21T13:58:03Z

• cis-l1-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• cis-l1-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• cis-l1-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not selected, or waived are not counted.

To copy the report to your workstation, run this on the workstation:

scp -i ~/.ssh/my-key-pair.pem rocky@<public-ip>:/usr/share/doc/cloudimg/cis-l1-report.html .

The eight waived rules

grep -v '^#' /usr/share/doc/cloudimg/cis-l1-waivers.txt | cut -f1,2

Expected output:

partition_for_tmp   [single-volume-partitions]
grub2_password  [serial-console-and-boot]
grub2_uefi_password [serial-console-and-boot]
ensure_root_password_configured [serial-console-and-boot]
accounts_maximum_age_login_defs [key-only-account-aging]
account_disable_post_pw_expiration  [key-only-account-aging]
sshd_limit_user_access  [ssh-access-list]
service_systemd-journal-upload_enabled  [log-remote-destination]

The full reason for each is the third column of the same file. In short:

• Separate /tmp partition: this version boots from one EBS root volume. (The Rocky Linux 8 LVM version of this listing provides separate volumes for /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home, and scores those rules.)
• Boot loader and root passwords: a GRUB or root password would have to be baked into the image, giving every instance the same secret. Root stays locked with no password. Set your own if you need serial console access (see Step 11).
• Password ageing defaults: the accounts cloud-init creates are key-only. An ageing limit would expire them and lock the SSH key out. Accounts that do have a password are still aged.
• SSH AllowUsers/AllowGroups: a list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.
• Remote journal upload: the benchmark switches on systemd-journal-upload, which sends the system journal to a remote log server, but the image cannot know your log server. Switched on with no destination, the service fails at every boot. systemd-journal-remote is installed and the upload service is left off; to use it, see "Send the journal to your own log server" below.

Every scored rule passes

python3 -c "import json; print(json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json'))['failingRules'])"

Expected output:

[]

The list of failing rules is empty: every rule the profile scores on this image passes. Rules that do not apply to an EC2 instance (for example wireless interfaces) are reported as not applicable and are not counted.

Send the journal to your own log server

If you run a systemd-journal-remote collector, point the image at it and switch the upload service on (replace the address with your collector's):

echo 'URL=https://logs.example.internal:19532' | sudo tee -a /etc/systemd/journal-upload.conf
sudo systemctl enable --now systemd-journal-upload

Step 6: Re-run the evaluation yourself

You can repeat the evaluation at any time with the same content and tailoring. It takes about a minute:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/cloudimg/cis-l1-tailoring.xml \
  --profile xccdf_co.cloudimg_profile_cis-l1_ec2_single \
  --results /tmp/cis-check-results.xml --report /tmp/cis-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rl8-ds.xml > /tmp/cis-check.log 2>&1
echo "oscap exit code: $? (0 = every rule passed, 2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/cis-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output (measured on a fresh instance launched from this image):

oscap exit code: 0 (0 = every rule passed, 2 = at least one rule did not pass)
{'notapplicable': 38, 'notselected': 1369, 'pass': 294}
pass rate: 100.0%

Your own report is at /tmp/cis-check-report.html. The content file is ssg-rl8-ds.xml, the Rocky Linux 8 data stream; the RHEL 8 data stream that the same package carries reports every rule as not applicable on Rocky Linux. As you install software and change settings, re-run this to see how your changes affect the result.

Step 7: Confirm IMDSv2 is required

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401
us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2; every current AWS SDK and the AWS CLI do this automatically.

Step 8: The host firewall, listening ports and Cockpit

sudo firewall-cmd --state
sudo firewall-cmd --list-all
sudo ss -tlnp
systemctl is-enabled cockpit.socket
cat /etc/systemd/system-preset/80-cloudimg-cockpit.preset

Expected output:

running
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: dhcpv6-client ssh
  ports: 
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess                       
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*    users:(("sshd",pid=962,fd=3))
LISTEN 0      128             [::]:22           [::]:*    users:(("sshd",pid=962,fd=4))
disabled
# cloudimg: inbound SSH only. Enable the Cockpit web console yourself (see the user guide).
disable cockpit.socket

• Only sshd listens on a TCP port, port 22. The only other socket is chrony's local command port (UDP 323 on the loopback address), which is not reachable from the network.
• The public zone allows ssh and dhcpv6-client (replies to the instance's IPv6 DHCP client, which is how an instance in an IPv6-enabled subnet gets its address). The Rocky Linux default cockpit service is removed from the zone.
• The loopback interface sits in firewalld's trusted zone, with rules that drop traffic claiming a loopback source from anywhere else (a CIS requirement).
• The network interface is named eth0 on every instance type: the image boots with predictable interface names turned off (net.ifnames=0), as the Rocky Linux EC2 images do.

Opening a port for your own service takes two steps: allow it in the instance's security group, and allow it in firewalld. For example, for a web server on 443, run on the instance:

sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld (or the other way round), the traffic will not arrive.

Turning on the Cockpit web console. Cockpit (cockpit-ws, cockpit-system, cockpit-bridge) is installed as in a standard Rocky Linux system, but its socket is disabled, and the preset file shown above keeps it disabled if the system presets are applied again (for example by systemctl preset-all). If you want the console, run on the instance:

sudo systemctl enable --now cockpit.socket
sudo firewall-cmd --permanent --add-service=cockpit
sudo firewall-cmd --reload

Then allow TCP 9090 from your own address in the security group and browse to https://<public-ip>:9090. Cockpit signs in with a local account's password, so give your user one first (sudo passwd rocky); SSH stays key-only. Cockpit uses a self-signed certificate until you install your own. Prefer an SSH tunnel (ssh -L 9090:localhost:9090 ...) to opening 9090 to the internet.

Step 9: Time sync and the Systems Manager agent

systemctl is-active chronyd amazon-ssm-agent
chronyc -n sources

Expected output (the pool servers and timings vary):

active
active
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^- 99.28.14.242                  1   6   377    18  +1015us[+1015us] +/-   13ms
^- 198.46.254.130                2   6   377    16    +11us[  +11us] +/-   15ms
^- 69.10.208.170                 2   6   377    17  +3856ns[+3962ns] +/-   59ms
^- 38.80.8.230                   2   6   377    17  +8341ns[+8446ns] +/-   20ms
^* 169.254.169.123               3   4   377    16    +51ns[ +158ns] +/-  471us

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public Rocky Linux pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's own package at its current release (3.3.5390.0 on this build). It is not in the Rocky Linux repositories, so dnf does not update it; Systems Manager can keep it current for you (the AWS-UpdateSSMAgent document, or the Auto update SSM Agent setting in Fleet Manager).

Step 10: Patch level and automatic updates

The image is fully patched at build time. Check what is pending now:

sudo dnf -q check-update --refresh
echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)"
grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf
systemctl is-enabled dnf-automatic.timer
uname -r

Expected output on an instance launched soon after the image was built (later launches list the updates released since, with exit code 100):

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available)
upgrade_type = security
apply_updates = yes
enabled
4.18.0-553.176.1.el8_10.x86_64

dnf-automatic runs daily (06:00, with a random delay of up to an hour) and installs security updates automatically from the repositories described in Step 4. To update everything now, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

Step 11: Security settings on the instance

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval|banner) '
cat /etc/issue.net

Expected output:

Enforcing
root LK 2026-06-26 0 99999 7 -1 (Password locked.)
maxauthtries 4
clientaliveinterval 300
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
banner /etc/issue.net
Authorized users only. All activity may be monitored and reported.

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on; if your own software is denied, check sudo ausearch -m avc -ts recent rather than disabling SELinux.
• LK in the second field means the root account is locked.
• maxauthtries 4 and clientaliveinterval 300 come from the CIS profile: SSH allows four authentication attempts per connection and checks idle sessions every five minutes.
• The banner text is shown before login.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. If you want serial console access, set a password for your own user on your running instance (the password is yours and is not on the image):

sudo passwd rocky

Step 12: Disk size, swap and file integrity

df -hT /
sudo grep -E 'cc_growpart.*(resized|NOCHANGE)' /var/log/cloud-init.log | tail -1
swapon --noheadings --show | wc -l
sudo grep -h aide /etc/crontab

Expected output with the default 11 GiB root volume (on a larger volume, Size is larger and the cloud-init line says resized):

Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/nvme0n1p5 xfs    10G  3.8G  6.3G  38% /
2026-10-21 14:26:46,747 - cc_growpart.py[DEBUG]: '/' NOCHANGE: no change necessary (/dev/nvme0n1, 5)
0
05 4 * * * root /usr/sbin/aide --check

• Disk layout. The root filesystem is XFS on partition 5 of the root volume; /boot (XFS) and /boot/efi are separate small partitions.
• Disk growth. cloud-init grows the root partition and filesystem to the volume size on first boot. To grow later, increase the EBS volume size in the console or with aws ec2 modify-volume, then run sudo growpart /dev/nvme0n1 5 && sudo xfs_growfs / (or reboot).
• Swap. The image has no swap. Add a swap file yourself if your workload needs one.
• AIDE. The file integrity database is built from the image's own files, and the CIS profile schedules aide --check daily at 04:05 from /etc/crontab.

Step 13: Install software and add users

The instance uses the standard Rocky Linux 8 repositories (BaseOS, AppStream and Extras):

sudo dnf -q list --available nginx

Expected output (the version changes over time):

Available Packages
nginx.x86_64          1:1.14.1-9.module+el8.4.0+542+81547229           appstream

Rocky Linux 8 ships several versions of some software as application streams (for example sudo dnf module list nginx lists nginx 1.14 to 1.24); sudo dnf module enable nginx:1.24 before installing picks a newer stream. Install and start software in the usual way, for example sudo dnf -y install nginx then sudo systemctl enable --now nginx, and open its port in the security group and firewalld (Step 8). The AWS CLI is not on the image; install the current version from AWS (the AWS CLI install guide) if you need it.

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh
echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys (and restorecon gives the file the SELinux label sshd expects). The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice. SSH stays key-only; the password is used by sudo. (Password-free sudo is granted only to rocky, created by cloud-init, and to ssm-user, which the Systems Manager agent creates the first time you open a Session Manager session.)

Common use cases

• Change-controlled environments whose baseline or vendor support matrix names Rocky Linux 8.10 exactly
• Software certified or packaged for RHEL 8 compatible systems, including applications that still need the RHEL 8 user space (Python 3.6 platform tools, application streams)
• A base for workloads that must show CIS Level 1 alignment on an enterprise Linux 8, with the evaluation report already on the machine
• Build and test hosts that must verify software against the final RHEL 8 compatible point release
• A starting point for your own golden image: add your software, re-run Step 6, and keep the report with your build

Troubleshooting

SSH says "Too many authentication failures"

The SSH server allows four authentication attempts per connection. If your SSH agent holds several keys, it can use them up before it offers the right one. Tell SSH to offer only the key you name:

ssh -o IdentitiesOnly=yes -i ~/.ssh/my-key-pair.pem rocky@<public-ip>

Cannot connect via SSH

1. Check the instance is running and has passed its status checks.
2. Check the security group allows TCP 22 from your current public address.
3. Use the user name rocky (not ec2-user) and the key pair chosen at launch. Password login is disabled, so a wrong key never falls back to a password prompt.
4. If you changed firewalld, make sure the ssh service is still allowed. Session Manager (Step 2) still works if SSH is blocked, provided the instance has a Systems Manager instance profile.

My service is running but not reachable

Allow the port in both the security group and firewalld (Step 8). sudo firewall-cmd --list-all shows the firewalld rules; sudo ss -tlnp shows whether the service listens on all addresses or only on loopback. If the service runs on a non-standard port, SELinux may also need to allow it, for example sudo semanage port -a -t http_port_t -p tcp 8080 for a web server on 8080 (semanage is in policycoreutils-python-utils; install it with sudo dnf -y install policycoreutils-python-utils if it is missing).

A tool that uses instance metadata fails

The image requires IMDSv2. Old scripts that call http://169.254.169.254/ without a token get HTTP 401. Update them to request a token first (Step 7), or use the AWS CLI or a current SDK.

Package manager issues

Refresh the metadata first:

sudo dnf -q makecache --refresh && echo "repository metadata refreshed"

If the repositories are unreachable, check that the instance has outbound internet access (a public IP or a NAT gateway) and that DNS resolves:

getent hosts dl.rockylinux.org

Important notes

Rocky Linux is free and open source software. It is a distribution of thousands of packages, each under its own licence (GPL, LGPL, MIT, BSD, Apache 2.0 and others); rpm -qi <package> shows each package's licence. No subscription or licence key is needed to run this image. The compliance tooling is OpenSCAP (LGPL 2.1 or later) and SCAP Security Guide content (BSD 3-Clause, licence text in /usr/share/doc/cloudimg/scap-security-guide-LICENSE.txt).

Rocky Linux 8 is maintained by the Rocky Enterprise Software Foundation until 31 May 2029, and 8.10 is its final point release, so an instance launched from this image stays on 8.10 and keeps receiving security updates through dnf until then (Step 4).

The CIS Level 1 Server profile used here is the OpenSCAP profile published in SCAP Security Guide. These images are not CIS Hardened Images and are not certified by the Center for Internet Security. A pass rate measures this image as built; your own changes affect it, which is why the evaluation can be re-run (Step 6).

Rocky Linux is a trademark of the Rocky Enterprise Software Foundation. Red Hat Enterprise Linux is a trademark of Red Hat, Inc. CIS is a trademark of the Center for Internet Security. These names are used only to identify the software, its compatibility and the profile. cloudimg is not affiliated with or endorsed by the Rocky Enterprise Software Foundation, Red Hat or the Center for Internet Security.

Support

For help with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• User Guides: www.cloudimg.co.uk/guides
• Rocky Linux on AWS hub: www.cloudimg.co.uk/guides/rocky-linux-aws