Rocky Linux 9 Essential Eight on AWS User Guide

Overview

This guide covers launching and verifying the Rocky Linux 9 Essential Eight AMI from cloudimg on Amazon EC2. It is one version of the cloudimg Rocky Linux listing on AWS Marketplace; you pick it as the software version when you subscribe and launch. Every release and variant in the listing is described at /guides/rocky-linux-aws/.

Rocky Linux 9 is a free, community enterprise Linux distribution that is binary compatible with Red Hat Enterprise Linux 9, maintained by the Rocky Enterprise Software Foundation with security updates until 2032. This image starts from the official Rocky Linux 9 image for EC2 (point release 9.8 at the time of this build) and adds four things:

• ACSC Essential Eight remediation. The image is remediated with the OpenSCAP ACSC Essential Eight profile from SCAP Security Guide 0.1.82 (Rocky Linux's own signed scap-security-guide package, content ssg-rl9), then rebooted and evaluated. On this build 88 of 88 scored rules pass (100.0%), measured again on a fresh instance launched from the finished image. Two rules are waived because they would lock the EC2 default user out of sudo, each with its reason. The HTML report, the machine-readable results, the tailoring, the waiver list and a summary ship in /usr/share/doc/cloudimg/.
• Application control. The profile installs and enables fapolicyd, the file access policy daemon: programs installed from signed RPM packages run as normal, and an executable that no package installed is refused for every ordinary account (Step 6 shows it, the one exception for root, and how to allow your own software).
• EC2 defaults that keep you in control. Key-only SSH as rocky, root locked, no password on any account, SELinux enforcing, IMDSv2 required, a host firewall (firewalld) that allows SSH in and everything out, the current AWS Systems Manager agent, and time from the Amazon Time Sync Service.
• Fully patched at build time, with dnf-automatic applying security updates on your instance.

What Essential Eight hardening means on an operating system

The Essential Eight is the Australian Cyber Security Centre's (ACSC) set of eight mitigation strategies. Most of them (backups, multi-factor authentication, Office macros, user application hardening) are about how an organisation runs its systems, not settings an image can carry. The SCAP Security Guide ACSC Essential Eight profile is the subset that can be configured and checked automatically on a Linux server, 94 rules in this release. On this image they cover:

• Application control: fapolicyd installed and enforcing; no telnet or squid; the network sniffer (promiscuous mode) check.
• Patch operating systems: packages only from GPG-checked repositories (gpgcheck on, including for local packages), and dnf-automatic applying security updates.
• Restrict administrative privileges: root SSH login refused, sudo rules without !authenticate, empty passwords refused, no second UID 0 account.
• System hardening: SELinux enforcing (targeted), the system-wide crypto policy DEFAULT:NO-SHA1, kernel settings that block kexec loading, unprivileged BPF and cross-process ptrace, /dev/shm mounted noexec,nosuid,nodev, RPM file ownership and permissions intact.
• Logging and audit: auditd with 44 audit rules (sudoers, time, users and groups, network configuration, SELinux and kernel module changes), rsyslog, and SSH logging at INFO with the last login shown.
• Regular backups: the rear (Relax-and-Recover) disaster recovery tool is installed for you to configure.

What is on the image: Rocky Linux 9.8 (the RHEL 9 compatible 5.14 kernel), cloud-init, OpenSSH, firewalld, fapolicyd, chrony, SELinux (targeted policy, enforcing), the AWS Systems Manager agent, auditd, rsyslog, Relax-and-Recover (rear), dnf-automatic, OpenSCAP and the pinned SCAP Security Guide content used for the evaluation.

Default user: rocky · Architecture: x86_64 · Root volume: 11 GiB gp3, XFS (grows to the size you choose at launch)

These images are remediated with an OpenSCAP profile and ship their own evaluation report. The profile checks a technical subset of the Essential Eight on one server; it is not an ACSC assessment, and it does not measure an Essential Eight maturity level, which is assessed across your whole environment.

Connecting to your instance

Version	SSH user	Root device
Rocky Linux 9 Essential Eight	rocky	/dev/sda1 (11 GiB gp3)

Security posture

• No known credential. There is no default password and no baked in SSH key. The only key that works is the EC2 key pair you choose at launch, which cloud-init installs for rocky on first boot.
• Key-only SSH. PasswordAuthentication no, PermitRootLogin no, keyboard-interactive off, X11 forwarding off. The root account has no password and is locked.
• Per-instance identity. SSH host keys and the machine ID are generated fresh on every instance, so no two instances share a host key.
• IMDSv2 required. The AMI is registered with ImdsSupport v2.0, so instances launched from it refuse token-less (IMDSv1) metadata requests by default.
• Application control. fapolicyd refuses to run, for any non-root account, executables that no RPM package installed.
• SELinux enforcing with the targeted policy, as Rocky Linux ships it.
• Host firewall. firewalld's public zone allows only SSH and the DHCPv6 client inbound and allows all outbound traffic, so the SSM agent, metadata service, DNS, time and package updates keep working.
• Only SSH listens on the network. Nothing else on the image listens on any network address, TCP or UDP. The RPC port mapper (rpcbind, port 111) that the base Rocky Linux image runs is removed, together with the NFS client tools that required it.

Prerequisites

1. An AWS account and permission to launch EC2 instances
2. An EC2 key pair in the Region you launch in
3. A security group that allows TCP 22 from your own address (not from the whole internet)

Recommended instance type: m5.large. The image runs on any current x86_64 instance type.

Step 1: Launch the instance

Option A: AWS Marketplace console

1. Open the cloudimg Rocky Linux listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Once the subscription is active, choose Launch your software.
3. Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for full control), then in Version choose Rocky Linux 9 Essential Eight - YYYY-MM-DD HH:MM (the date and time are when the version was added) and your Region.
4. Instance type: m5.large is recommended; any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
5. Key pair: choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.
6. Security group: allow inbound TCP 22 from your own IP address or network only.
7. Storage: the root volume is 11 GiB gp3 by default. Choose a larger size if you need one; cloud-init grows the root partition and filesystem to fill it on first boot.
8. Metadata: leave the defaults. The image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and the key pair, security group and subnet with your own. The root device of this AMI is /dev/sda1:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rocky-9-essential-eight}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

Step 2: Connect via SSH

From your workstation, connect as rocky with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem rocky@<public-ip>

There is no password to enter. If SSH asks for one, see Troubleshooting below.

You can also connect without opening port 22 at all through AWS Systems Manager Session Manager, if the instance has an instance profile that allows Systems Manager. The agent is installed and running on this image.

Step 3: Confirm the release

cat /etc/rocky-release
grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release
uname -srm

Expected output:

Rocky Linux release 9.8 (Blue Onyx)
NAME="Rocky Linux"
VERSION="9.8 (Blue Onyx)"
ID="rocky"
VERSION_ID="9.8"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Rocky Linux 9.8 (Blue Onyx)"
Linux 5.14.0-687.58.1.el9_8.x86_64 x86_64

This version follows Rocky Linux 9: it receives every Rocky Linux 9 minor release (9.8 at build time) through normal dnf updates. Your kernel version may be newer if updates have installed since this image was built.

Step 4: Read the compliance evidence

The evaluation the build ran after its reboot ships on the image:

ls -lh /usr/share/doc/cloudimg/
python3 -c "import json; s=json.load(open('/usr/share/doc/cloudimg/e8-summary.json')); print('profile:      ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived:       ', s['waived'], ' not applicable:', s['notapplicable'], ' not checked:', s['notchecked']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 38M
-rw-r--r--. 1 root root  36M Oct 21 20:12 e8-arf.xml
-rw-r--r--. 1 root root 1.3M Oct 21 20:12 e8-report.html
-rw-r--r--. 1 root root 1.2K Oct 21 20:12 e8-summary.json
-rw-r--r--. 1 root root 1.1K Oct 21 20:12 e8-tailoring.xml
-rw-r--r--. 1 root root  816 Oct 21 20:12 e8-waivers.txt
-rw-r--r--. 1 root root 1.6K Oct 21 20:03 scap-security-guide-LICENSE.txt
profile:       ACSC Essential Eight (SCAP Security Guide 0.1.82)
scored rules:  88  pass: 88  fail: 0  rate: 100.0%
waived:        2  not applicable: 3  not checked: 1
evaluated at:  2026-10-21T20:12:29Z

• e8-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• e8-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• e8-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 5).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not checked, not selected, or waived are not counted.

To copy the report to your workstation, run this on the workstation:

scp -i ~/.ssh/my-key-pair.pem rocky@<public-ip>:/usr/share/doc/cloudimg/e8-report.html .

The two waived rules

grep -v '^#' /usr/share/doc/cloudimg/e8-waivers.txt | cut -f1,2

Expected output:

sudo_remove_nopasswd    [default-user-sudo]
sudo_require_authentication [default-user-sudo]

Both rules would make every sudo command ask for a password. On EC2 the default user rocky is key-only and has no password, and cloud-init gives it password-free sudo (/etc/sudoers.d/90-cloud-init-users). With these two rules applied, the only administrator account could never use sudo again, and there is no password to recover with. The full reason is the third column of the same file. If your organisation requires sudo re-authentication, give your administrators passwords first, then remove the NOPASSWD grant (Step 12).

The related rule sudo_remove_no_authenticate (no !authenticate in sudoers) is applied and passes.

Rules that are not scored

python3 -c "import re; x=open('/usr/share/doc/cloudimg/e8-arf.xml').read(); [print(m.group(1), m.group(2)) for m in re.finditer(r'<rule-result idref=\"xccdf_org.ssgproject.content_rule_([^\"]+)\"[^>]*>.*?<result>(notapplicable|notchecked)</result>', x, re.S)]" | sort -u

Expected output:

package_tftp-server_removed notapplicable
prefer_64bit_os notchecked
service_cockpit_disabled notapplicable
timer_dnf-automatic_enabled notapplicable

• package_tftp-server_removed and service_cockpit_disabled are not applicable because neither package is installed.
• timer_dnf-automatic_enabled reports not applicable in this content release; the timer is enabled all the same (Step 11).
• prefer_64bit_os has no automated check. The image is x86_64 (Step 3).

Step 5: Re-run the evaluation yourself

You can repeat the evaluation at any time with the same content and tailoring. It takes about a minute and a half:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/cloudimg/e8-tailoring.xml \
  --profile xccdf_co.cloudimg_profile_e8_ec2_single \
  --results /tmp/e8-check-results.xml --report /tmp/e8-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rl9-ds.xml > /tmp/e8-check.log 2>&1
echo "oscap exit code: $? (0 = every scored rule passed, 2 = at least one did not)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/e8-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 0 (0 = every scored rule passed, 2 = at least one did not)
{'notapplicable': 3, 'notchecked': 1, 'notselected': 1448, 'pass': 88}
pass rate: 100.0%

Your own report is at /tmp/e8-check-report.html. Use ssg-rl9-ds.xml, Rocky Linux's own content: the package also carries ssg-rhel9-ds.xml, whose rules apply only to Red Hat Enterprise Linux and report "not applicable" on Rocky Linux. As you install software and change settings, re-run this to see how your changes affect the result.

Step 6: Application control with fapolicyd

Application control is the first of the Essential Eight. On this image it is enforced by fapolicyd: every time a program is executed, or a script in a language such as Python or Perl is opened, fapolicyd checks the file against its trust database. Files installed by RPM packages (the Rocky Linux repositories, and anything else you install with dnf) are trusted automatically. An executable that arrived any other way, such as a copied, downloaded or compiled binary, is refused for every ordinary account. Root is the exception: Rocky Linux's own 20-dracut.rules lets any trusted program running as root (a root shell, sudo, dracut) execute or open any file, so fapolicyd does not stop an administrator.

systemctl is-active fapolicyd
sudo grep -E '^(permissive|trust|integrity) ' /etc/fapolicyd/fapolicyd.conf
install -m 0755 /usr/bin/date /tmp/my-date
sudo -u rocky /tmp/my-date || echo "exit code $?: fapolicyd refused to run /tmp/my-date for rocky (an untrusted copy)"
sudo /tmp/my-date > /dev/null && echo "root, through a trusted program, may still run it (20-dracut.rules)"
rm -f /tmp/my-date

Expected output:

active
permissive = 0
trust = rpmdb,file
integrity = none
sudo: unable to execute /tmp/my-date: Operation not permitted
exit code 1: fapolicyd refused to run /tmp/my-date for rocky (an untrusted copy)
root, through a trusted program, may still run it (20-dracut.rules)

• permissive = 0 means fapolicyd enforces its rules (with 1 it would only log what it would have denied).
• trust = rpmdb,file: a file is trusted if the RPM database lists it, or if it is in a trust file under /etc/fapolicyd/trust.d/.
• The copy of /usr/bin/date is byte-for-byte the same program, but it is not where an RPM put it, so it is refused for rocky (and for any other non-root account).
• 20-dracut.rules (allow perm=any uid=0 trust=1 : all) is Rocky Linux's default and lets root, working through a trusted program, run the copy. Treat root access as fully trusted, and keep untrusted code away from root shells.
• On fapolicyd 1.4.5, running fapolicyd-cli trust-database checks (such as --check-trustdb) as root can stop the daemon at the next package update; if you run one, follow it with sudo systemctl restart fapolicyd and confirm it is active.

The rules that make the decision are Rocky Linux's defaults:

sudo sh -c 'grep -v "^#" /etc/fapolicyd/rules.d/20-dracut.rules /etc/fapolicyd/rules.d/42-trusted-elf.rules /etc/fapolicyd/rules.d/70-trusted-lang.rules /etc/fapolicyd/rules.d/72-shell.rules /etc/fapolicyd/rules.d/90-deny-execute.rules /etc/fapolicyd/rules.d/95-allow-open.rules' | grep -v ':$'

Expected output:

/etc/fapolicyd/rules.d/20-dracut.rules:allow perm=any uid=0 : dir=/var/tmp/
/etc/fapolicyd/rules.d/20-dracut.rules:allow perm=any uid=0 trust=1 : all
/etc/fapolicyd/rules.d/42-trusted-elf.rules:allow perm=execute all : trust=1
/etc/fapolicyd/rules.d/70-trusted-lang.rules:allow perm=open all : ftype=%languages trust=1
/etc/fapolicyd/rules.d/70-trusted-lang.rules:deny_audit perm=any all : ftype=%languages
/etc/fapolicyd/rules.d/72-shell.rules:allow perm=any all : ftype=text/x-shellscript
/etc/fapolicyd/rules.d/90-deny-execute.rules:deny_audit perm=execute all : all
/etc/fapolicyd/rules.d/95-allow-open.rules:allow perm=open all : all

Trusted programs may execute; scripts in interpreted languages (Python, Perl, Ruby, Java and others) are allowed only from trusted files; shell scripts are allowed; any other execution is denied and audited, and reading ordinary files is allowed. Shell scripts are allowed, so cloud-init user data and Systems Manager Run Command scripts work as usual.

Running your own software. Install it from an RPM package where you can: dnf updates the trust database for you. For software that arrives another way (a release tarball, a binary you build, an application under /opt), add it to a trust file and reload the trust database before you first run it:

sudo fapolicyd-cli --file add /opt/myapp/ --trust-file myapp
sudo fapolicyd-cli --update

If a program was already refused once, fapolicyd may still hold that decision; sudo systemctl restart fapolicyd clears it. After an upgrade of that software, run sudo fapolicyd-cli --file update /opt/myapp/ --trust-file myapp and sudo fapolicyd-cli --update again. Denials are logged in the audit log (sudo ausearch -m FANOTIFY -ts recent).

Step 7: The other Essential Eight settings

update-crypto-policies --show
sudo sysctl kernel.kexec_load_disabled kernel.yama.ptrace_scope kernel.unprivileged_bpf_disabled kernel.dmesg_restrict kernel.kptr_restrict net.core.bpf_jit_harden kernel.randomize_va_space
findmnt -no OPTIONS /dev/shm
systemctl is-active auditd rsyslog
sudo auditctl -l | wc -l
grep -E '^gpgcheck|^localpkg_gpgcheck' /etc/dnf/dnf.conf
rpm -q rear

Expected output:

DEFAULT:NO-SHA1
kernel.kexec_load_disabled = 1
kernel.yama.ptrace_scope = 1
kernel.unprivileged_bpf_disabled = 1
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 1
net.core.bpf_jit_harden = 2
kernel.randomize_va_space = 2
rw,nosuid,nodev,noexec,seclabel,inode64
active
active
44
gpgcheck=1
localpkg_gpgcheck = 1
rear-2.6-28.el9.x86_64

• Crypto policy DEFAULT:NO-SHA1: TLS, SSH and other system crypto libraries refuse SHA-1 signatures. Current EC2 key pairs (RSA with SHA-2 signatures, ED25519) are unaffected; a very old SSH client that can only sign with ssh-rsa (SHA-1) cannot log in.
• Kernel settings: kexec cannot load a new kernel at run time (so kdump is not available), only a parent process can ptrace its children, unprivileged users cannot load BPF programs, kernel addresses and the kernel log are hidden from unprivileged users, and address space layout randomisation is fully on.
• /dev/shm noexec: nothing can be executed from shared memory.
• auditd loads 44 rules, so changes to sudoers, users and groups, time, network configuration, SELinux and kernel modules are recorded in /var/log/audit/audit.log; rsyslog writes the system log.
• GPG checking is on for repository packages and for local .rpm files.
• Relax-and-Recover (rear) is installed for the backup strategy; configure it yourself (Step 13).

Step 8: Confirm IMDSv2 is required

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401
us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2; every current AWS SDK and the AWS CLI do this automatically.

Step 9: The host firewall and listening ports

sudo firewall-cmd --state
sudo firewall-cmd --list-all
sudo ss -tlnp

Expected output:

running
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: dhcpv6-client ssh
  ports: 
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess                       
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*    users:(("sshd",pid=909,fd=7))
LISTEN 0      128             [::]:22           [::]:*    users:(("sshd",pid=909,fd=8))

• Only sshd listens, on port 22. Nothing else on the image opens a TCP port, and the only UDP socket is chrony's local command port on 127.0.0.1:323 and [::1]:323 (sudo ss -ulnp), which is not reachable from the network.
• The RPC port mapper (rpcbind, port 111) that the base Rocky Linux image runs is removed, together with the NFS client tools (nfs-utils) that required it. To mount NFS or Amazon EFS file systems, install them with sudo dnf -y install nfs-utils; rpcbind comes back with them, and firewalld still keeps port 111 closed to inbound traffic.
• The public zone allows ssh and dhcpv6-client (replies to the instance's IPv6 DHCP client, which is how an instance in an IPv6-enabled subnet gets its address). The Rocky Linux default cockpit service is removed from the zone; Cockpit is not installed.

Opening a port for your own service takes two steps: allow it in the instance's security group, and allow it in firewalld. For example, for a web server on 443, run on the instance:

sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld (or the other way round), the traffic will not arrive.

Step 10: Time sync and the Systems Manager agent

systemctl is-active chronyd amazon-ssm-agent
chronyc -n sources
rpm -q --qf '%{VERSION}\n' amazon-ssm-agent

Expected output (the pool servers and timings vary):

active
active
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^- 38.80.8.230                   2   6   377    64   +162us[ +148us] +/-   19ms
^- 192.231.84.118                2   6   377    65   -476us[ -489us] +/-   30ms
^- 107.161.86.210                2   6   377     0  -2747us[-2747us] +/-   19ms
^- 207.58.172.126                3   6   377    64   -229us[ -243us] +/- 3956us
^* 169.254.169.123               3   4   377    15  +4785ns[-3469ns] +/-  411us
3.3.5538.0

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public Rocky Linux pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's own RPM at its current release (3.3.5538.0 on this build), so fapolicyd trusts it. It is not in the Rocky Linux repositories, so dnf does not update it; Systems Manager can keep it current for you (the AWS-UpdateSSMAgent document, or the Auto update SSM Agent setting in Fleet Manager).

Step 11: Patch level and automatic updates

The image is fully patched at build time. Check what is pending now:

sudo dnf -q check-update --refresh
echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)"
grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf
systemctl is-enabled dnf-automatic.timer
uname -r

Expected output on an instance launched soon after the image was built (later launches list the updates released since, with exit code 100):

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available)
upgrade_type = security
apply_updates = yes
enabled
5.14.0-687.58.1.el9_8.x86_64

dnf-automatic runs daily (06:00, with a random delay of up to an hour) and installs security updates automatically, which is the Essential Eight "patch operating systems" strategy. Packages from the repositories stay trusted by fapolicyd after an update. To update everything now, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

Step 12: Security settings on the instance

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|gssapiauthentication|permituserenvironment|printlastlog|loglevel|x11forwarding|kbdinteractiveauthentication) '
sudo cat /etc/sudoers.d/90-cloud-init-users | grep -v '^#' | sort -u | grep .

Expected output:

Enforcing
root LK 2026-06-24 0 99999 7 -1 (Password locked.)
permitrootlogin no
pubkeyauthentication yes
gssapiauthentication no
passwordauthentication no
kbdinteractiveauthentication no
printlastlog yes
x11forwarding no
loglevel INFO
permituserenvironment no
rocky ALL=(ALL) NOPASSWD:ALL

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on; if your own software is denied, check sudo ausearch -m avc -ts recent rather than disabling SELinux.
• LK means the root account is locked.
• sshd -T prints the settings sshd actually uses. They come from the profile and the image: no root login, key-only authentication, no GSSAPI or host-based trust, no X11 forwarding, no user environment overrides, the last login shown at sign-in, and logging at INFO.
• rocky ALL=(ALL) NOPASSWD:ALL is the password-free sudo grant cloud-init writes for the EC2 default user (the two waived rules, Step 4).

Requiring a password for sudo. If your policy requires sudo re-authentication, first give each administrator a password (sudo passwd rocky; SSH stays key-only, the password is only used by sudo), confirm sudo -k; sudo true asks for it and works, and only then change NOPASSWD:ALL to ALL with sudo visudo -f /etc/sudoers.d/90-cloud-init-users. Doing it the other way round locks you out of sudo.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one, as above.

Step 13: Disk size, swap and backups

df -hT /
sudo grep -E 'cc_growpart.*(resized|NOCHANGE)' /var/log/cloud-init.log | tail -1
swapon --noheadings --show | wc -l

Expected output with the default 11 GiB root volume (on a larger volume, Size is larger and the cloud-init line says resized):

Filesystem     Type  Size  Used Avail Use% Mounted on
/dev/nvme0n1p4 xfs   9.9G  1.5G  8.4G  16% /
2026-10-21 20:45:23,268 - cc_growpart.py[DEBUG]: '/' NOCHANGE: no change necessary (/dev/nvme0n1, 4)
0

• Disk layout. The root filesystem is XFS on partition 4 of the root volume; /boot (XFS) and /boot/efi are separate small partitions.
• Disk growth. cloud-init grows the root partition and filesystem to the volume size on first boot. To grow later, increase the EBS volume size in the console or with aws ec2 modify-volume, then run sudo growpart /dev/nvme0n1 4 && sudo xfs_growfs / (or reboot).
• Swap. The image has no swap. Add a swap file yourself if your workload needs one.
• Backups. Relax-and-Recover (rear) is installed but not configured; point it at your own backup target in /etc/rear/local.conf, or use EBS snapshots and AWS Backup.

Step 14: Install software and add users

The instance uses the standard Rocky Linux 9 repositories (BaseOS, AppStream and Extras):

sudo dnf -q list --available nginx

Expected output (the version changes over time):

Available Packages
nginx.x86_64               2:1.20.1-28.el9_8.6.rocky.0.1               appstream

Install and start software in the usual way, for example sudo dnf -y install nginx then sudo systemctl enable --now nginx, and open its port in the security group and firewalld (Step 9). Software installed with dnf is trusted by fapolicyd automatically; software installed any other way needs a trust entry (Step 6). Re-run the evaluation (Step 5) afterwards to see whether the new software changed the result. The AWS CLI is not on the image; install the current version from AWS (the AWS CLI install guide) and add it to fapolicyd's trust (sudo fapolicyd-cli --file add /usr/local/aws-cli/ --trust-file awscli, then sudo fapolicyd-cli --update), or run it in AWS CloudShell instead.

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh
echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys (and restorecon gives the file the SELinux label sshd expects). The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice. SSH stays key-only; the password is used by sudo. (Only rocky, created by cloud-init, has password-free sudo.)

Common use cases

• Workloads that must show the technical Essential Eight controls on an enterprise Linux 9 server, with the evaluation report already on the machine
• Servers where only packaged, signed software may run for ordinary accounts (application control from the first boot)
• Software certified or packaged for RHEL 9 compatible systems, with SELinux enforcing from the first boot
• Fleets managed through Systems Manager, with IMDSv2 required from the first boot
• A starting point for your own golden image: add your software, trust it in fapolicyd, re-run Step 5, and keep the report with your build

Troubleshooting

A program fails with "Operation not permitted"

That is fapolicyd refusing an executable or script that no RPM package installed (it refuses for every account except root working through a trusted program). Check the audit log:

sudo ausearch -m FANOTIFY -ts recent

Install the software from a package, or add it to a trust file and restart fapolicyd (Step 6). Do not disable fapolicyd to work around it: application control is the point of this version, and turning it off fails the evaluation.

fapolicyd is not running

systemctl is-active fapolicyd should print active. If it prints failed (for example after a fapolicyd-cli trust-database check followed by a package update, Step 6), restart it and confirm:

sudo systemctl restart fapolicyd
systemctl is-active fapolicyd

Cannot connect via SSH

1. Check the instance is running and has passed its status checks.
2. Check the security group allows TCP 22 from your current public address.
3. Use the user name rocky and the key pair chosen at launch. Password login is disabled, so a wrong key never falls back to a password prompt.
4. A very old SSH client that only signs with SHA-1 (ssh-rsa) is refused by the DEFAULT:NO-SHA1 crypto policy; update the client (OpenSSH 7.2 or later signs with SHA-2).
5. If your SSH agent holds several keys and SSH says Too many authentication failures, offer only the right one: ssh -o IdentitiesOnly=yes -i ~/.ssh/my-key-pair.pem rocky@<public-ip>.
6. If you changed firewalld, make sure the ssh service is still allowed. Session Manager (Step 2) still works if SSH is blocked, provided the instance has a Systems Manager instance profile.

My service is running but not reachable

Allow the port in both the security group and firewalld (Step 9). sudo firewall-cmd --list-all shows the firewalld rules; sudo ss -tlnp shows whether the service listens on all addresses or only on loopback. If the service runs on a non-standard port, SELinux may also need to allow it: install the SELinux management tools with sudo dnf -y install policycoreutils-python-utils, then, for example, sudo semanage port -a -t http_port_t -p tcp 8080 for a web server on 8080.

A tool that uses instance metadata fails

The image requires IMDSv2. Old scripts that call http://169.254.169.254/ without a token get HTTP 401. Update them to request a token first (Step 8), or use the AWS CLI or a current SDK.

Package manager issues

Refresh the metadata first:

sudo dnf -q makecache --refresh && echo "repository metadata refreshed"

If the repositories are unreachable, check that the instance has outbound internet access (a public IP or a NAT gateway) and that DNS resolves:

getent hosts dl.rockylinux.org

Important notes

Rocky Linux is free and open source software. It is a distribution of thousands of packages, each under its own licence (GPL, LGPL, MIT, BSD, Apache 2.0 and others); rpm -qi <package> shows each package's licence. No subscription or licence key is needed to run this image. The compliance tooling is OpenSCAP (LGPL 2.1 or later) and SCAP Security Guide content (BSD 3-Clause, licence text in /usr/share/doc/cloudimg/scap-security-guide-LICENSE.txt).

Rocky Linux 9 receives security updates from the Rocky Enterprise Software Foundation until 2032. This version tracks the Rocky Linux 9 release stream, so new minor releases arrive as ordinary updates.

The ACSC Essential Eight profile used here is the OpenSCAP profile published in SCAP Security Guide, as Rocky Linux packages it (ssg-rl9). It checks the technical controls of the Essential Eight that can be automated on one Linux server. This image is not an ACSC assessment, is not endorsed by the Australian Signals Directorate or the ACSC, and does not establish an Essential Eight maturity level for your organisation. A pass rate measures this image as built; your own changes affect it, which is why the evaluation can be re-run (Step 5).

Rocky Linux is a trademark of the Rocky Enterprise Software Foundation. Red Hat Enterprise Linux is a trademark of Red Hat, Inc. These names are used only to identify the software and its compatibility. cloudimg is not affiliated with or endorsed by the Rocky Enterprise Software Foundation, Red Hat, the Australian Signals Directorate or the Australian Cyber Security Centre.

Support

For help with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• User Guides: www.cloudimg.co.uk/guides
• Rocky Linux on AWS hub: www.cloudimg.co.uk/guides/rocky-linux-aws