Ubuntu 22.04 LTS LVM on AWS User Guide

Overview

This guide covers launching and verifying the Ubuntu 22.04 LTS LVM AMI from cloudimg on Amazon EC2. It is one version of the cloudimg Ubuntu listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

Ubuntu 22.04 is a long term support (LTS) release from Canonical, with standard security maintenance to 2027. This image starts from Ubuntu Server 22.04 LTS for EC2 and adds four things:

• A hardened LVM disk layout. The root filesystem and six benchmark mount points are separate logical volumes in the volume group ubuntu-vg: /home, /tmp, /var, /var/tmp, /var/log and /var/log/audit. Each is mounted nodev,nosuid, and /tmp, /var/tmp, /var/log and /var/log/audit are also noexec. A full log or temp volume cannot fill the root filesystem, and you can grow any volume on its own (Step 12).
• CIS Level 1 Server remediation. The image is remediated with the OpenSCAP CIS Level 1 Server profile from SCAP Security Guide 0.1.82, then rebooted and evaluated. Because the partitions are real, the benchmark's partition and mount option rules are applied and scored rather than waived. On this build 355 of 360 scored rules pass (98.6%). Five rules are waived because they cannot work on an EC2 image, each with its reason. The HTML report, the machine-readable results, the waiver list and a summary ship in /usr/share/doc/cloudimg/.
• EC2 defaults that keep you in control. Key-only SSH as ubuntu, root locked, no password on any account, IMDSv2 required, a host firewall (ufw) that allows SSH in and everything out, the AWS Systems Manager agent installed as a normal package, and time from the Amazon Time Sync Service.
• Fully patched at build time, with unattended security upgrades switched on for your instance.

What is on the image: Ubuntu Server 22.04 LTS (AWS kernel), LVM2, cloud-init, OpenSSH, ufw, chrony, the AWS Systems Manager agent, AppArmor, AIDE file integrity checking, OpenSCAP and the pinned SCAP Security Guide content used for the evaluation.

Default user: ubuntu · Architecture: x86_64 · Root volume: 12 GiB gp3 (volume group ubuntu-vg, 820 MiB unallocated for growth)

These images are remediated with an OpenSCAP profile and ship their own evaluation report. They are not CIS Hardened Images, and CIS has not reviewed or certified them.

Security posture

• No known credential. There is no default password and no baked in SSH key. The only key that works is the EC2 key pair you choose at launch, which cloud-init installs for ubuntu on first boot.
• Key-only SSH. PasswordAuthentication no, PermitRootLogin no, keyboard-interactive off. The root password is locked.
• Per-instance identity. SSH host keys and the machine ID are generated fresh on every instance, so no two instances share a host key.
• IMDSv2 required. The AMI is registered with ImdsSupport v2.0, so instances launched from it refuse token-less (IMDSv1) metadata requests by default.
• Host firewall. ufw denies inbound traffic except SSH on 22 and allows outbound traffic, so the SSM agent, metadata service, DNS, time and package updates keep working.
• Only SSH listens on the network. Everything else on the image listens on loopback only.
• No executables from temp and log volumes. /tmp, /var/tmp, /var/log and /var/log/audit are mounted noexec, so a file dropped there cannot be run directly.

Prerequisites

1. An AWS account and permission to launch EC2 instances
2. An EC2 key pair in the Region you launch in
3. A security group that allows TCP 22 from your own address (not from the whole internet)

Recommended instance type: m5.large. The image runs on any current x86_64 instance type.

Step 1: Launch the instance

Option A: AWS Marketplace console

1. Open the cloudimg Ubuntu listing on AWS Marketplace and choose Continue to Subscribe, then Continue to Configuration.
2. Under Software version, choose Ubuntu 22.04 LTS LVM, then pick your Region and choose Continue to Launch.
3. Choose Launch through EC2 for the full launch wizard.
4. Pick an instance type (m5.large recommended) and your key pair.
5. Under Network settings, allow SSH (port 22) from My IP only.
6. Under Configure storage, set the root volume size you want (12 GiB minimum). Extra space is added to the disk but not allocated to a volume until you choose where it goes (Step 12).
7. Choose Launch instance.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and the key pair, security group and subnet with your own. The root device of this AMI is /dev/xvda:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/xvda,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=ubuntu-lvm}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

Step 2: Connect via SSH

From your workstation, connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

There is no password to enter. If SSH asks for one, or says Too many authentication failures, see Troubleshooting below.

You can also connect without opening port 22 at all through AWS Systems Manager Session Manager, if the instance has an instance profile that allows Systems Manager. The agent is installed and running on this image.

Step 3: Confirm the release

grep -E '^(NAME|VERSION|ID|VERSION_ID|PRETTY_NAME)=' /etc/os-release
uname -srm
dpkg --print-architecture

Expected output:

PRETTY_NAME="Ubuntu 22.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.5 LTS (Jammy Jellyfish)"
ID=ubuntu
Linux 6.8.0-1066-aws x86_64
amd64

The -aws kernel is Canonical's kernel flavour for EC2, with the Nitro network and NVMe drivers built in. Your kernel version may be newer if updates have installed since this image was built.

Step 4: See the LVM layout

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS /dev/nvme0n1
sudo vgs
sudo lvs -o lv_name,lv_size,lv_path ubuntu-vg
findmnt -lo TARGET,SOURCE,OPTIONS -t ext4,vfat

Expected output with the default 12 GiB root volume:

NAME                          SIZE TYPE FSTYPE      MOUNTPOINTS
nvme0n1                        12G disk             
├─nvme0n1p1                     1M part             
├─nvme0n1p2                   200M part vfat        /boot/efi
├─nvme0n1p3                     1G part ext4        /boot
└─nvme0n1p4                  10.8G part LVM2_member 
  ├─ubuntu--vg-root             4G lvm  ext4        /
  ├─ubuntu--vg-home             1G lvm  ext4        /home
  ├─ubuntu--vg-tmp              1G lvm  ext4        /tmp
  ├─ubuntu--vg-var            1.5G lvm  ext4        /var
  ├─ubuntu--vg-var_tmp        512M lvm  ext4        /var/tmp
  ├─ubuntu--vg-var_log          1G lvm  ext4        /var/log
  └─ubuntu--vg-var_log_audit    1G lvm  ext4        /var/log/audit
  VG        #PV #LV #SN Attr   VSize  VFree  
  ubuntu-vg   1   7   0 wz--n- 10.80g 820.00m
  LV            LSize   Path                        
  home            1.00g /dev/ubuntu-vg/home         
  root            4.00g /dev/ubuntu-vg/root         
  tmp             1.00g /dev/ubuntu-vg/tmp          
  var             1.50g /dev/ubuntu-vg/var          
  var_log         1.00g /dev/ubuntu-vg/var_log      
  var_log_audit   1.00g /dev/ubuntu-vg/var_log_audit
  var_tmp       512.00m /dev/ubuntu-vg/var_tmp      
TARGET         SOURCE                               OPTIONS
/              /dev/mapper/ubuntu--vg-root          rw,relatime
/boot          /dev/nvme0n1p3                       rw,nosuid,nodev,relatime
/tmp           /dev/mapper/ubuntu--vg-tmp           rw,nosuid,nodev,noexec,relatime
/var           /dev/mapper/ubuntu--vg-var           rw,nosuid,nodev,relatime
/boot/efi      /dev/nvme0n1p2                       rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=iso8859-1,shortname=winnt,errors=remount-ro
/home          /dev/mapper/ubuntu--vg-home          rw,nosuid,nodev,relatime
/var/log       /dev/mapper/ubuntu--vg-var_log       rw,nosuid,nodev,noexec,relatime
/var/tmp       /dev/mapper/ubuntu--vg-var_tmp       rw,nosuid,nodev,noexec,relatime
/var/log/audit /dev/mapper/ubuntu--vg-var_log_audit rw,nosuid,nodev,noexec,relatime

• The disk has a 1 MiB BIOS boot partition, a 200 MiB EFI system partition, a 1 GiB /boot and one LVM physical volume. The boot loader is installed for both BIOS and UEFI boot.
• The mount options are set in /etc/fstab by filesystem UUID, so they survive reboots and apply on every instance launched from the image.
• /dev/shm is also mounted nodev,nosuid,noexec.

Step 5: Read the compliance evidence

The evaluation the build ran after its reboot ships on the image:

ls -lh /usr/share/doc/cloudimg/
python3 -c "import json; s=json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json')); print('profile:      ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived:       ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 20M
-rw-r--r-- 1 root root  17M Oct 18 22:49 cis-l1-arf.xml
-rw-r--r-- 1 root root 2.6M Oct 18 22:49 cis-l1-report.html
-rw-r--r-- 1 root root 1.3K Oct 18 22:49 cis-l1-summary.json
-rw-r--r-- 1 root root 2.0K Oct 18 22:49 cis-l1-tailoring.xml
-rw-r--r-- 1 root root 2.0K Oct 18 22:49 cis-l1-waivers.txt
-rw-r--r-- 1 root root 1.6K Oct 18 22:44 scap-security-guide-LICENSE.txt
profile:       CIS Level 1 Server (SCAP Security Guide 0.1.82)
scored rules:  360  pass: 355  fail: 5  rate: 98.6%
waived:        5  not applicable: 33
evaluated at:  2026-10-18T22:49:18Z

• cis-l1-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• cis-l1-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• cis-l1-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not selected, or waived are not counted.

To copy the report to your workstation, run this on the workstation:

scp -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>:/usr/share/doc/cloudimg/cis-l1-report.html .

The five waived rules

grep -v '^#' /usr/share/doc/cloudimg/cis-l1-waivers.txt | cut -f1,2

Expected output:

grub2_password  [serial-console-and-boot]
grub2_uefi_password [serial-console-and-boot]
accounts_maximum_age_login_defs [key-only-account-aging]
account_disable_post_pw_expiration  [key-only-account-aging]
sshd_limit_user_access  [ssh-access-list]

The full reason for each is the third column of the same file. In short:

• Boot loader passwords: a GRUB password would have to be baked into the image, giving every instance the same secret. Set your own if you need one (see Step 11).
• Password ageing defaults: the accounts cloud-init creates are key-only. An ageing limit would expire them and lock the SSH key out.
• SSH AllowUsers/AllowGroups: a list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.

The separate partition rules (/tmp, /var, /var/tmp, /var/log, /var/log/audit, /home) are not waived on this version: they are scored, and they pass.

The five rules that do not pass

python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json'))['failingRules']]"

Expected output:

ensure_root_access_controlled
service_nftables_enabled
set_nftables_loopback_traffic
set_nftables_table
set_ufw_default_rule

What each one means on this image:

• ensure_root_access_controlled: the Ubuntu 22.04 content passes this rule only when root has a password hash. This image has no password on any account, because a password set at build time would be the same on every instance; root is locked instead (Step 11). If your policy requires a root password, set your own with sudo passwd root.
• service_nftables_enabled, set_nftables_loopback_traffic and set_nftables_table: these check an nftables service with a hand-written configuration. The firewall on this image is ufw, and the nftables service is masked so it cannot flush ufw's rules at boot, so they do not describe it.
• set_ufw_default_rule: the benchmark wants outbound traffic denied by default. This image allows outbound so the SSM agent, metadata service, DNS, time sync and updates work out of the box.

Step 6: Re-run the evaluation yourself

You can repeat the evaluation at any time with the same content and tailoring. It takes about a minute:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/cloudimg/cis-l1-tailoring.xml \
  --profile xccdf_co.cloudimg_profile_cis-l1_ec2_lvm \
  --cpe /usr/share/cloudimg/openscap/ssg-split/ssg-ubuntu2204-cpe-dictionary.xml \
  --results /tmp/cis-check-results.xml --report /tmp/cis-check-report.html \
  /usr/share/cloudimg/openscap/ssg-split/ssg-ubuntu2204-xccdf.xml > /tmp/cis-check.log 2>&1
echo "oscap exit code: $? (2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/cis-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 2 (2 = at least one rule did not pass)
{'fail': 5, 'notapplicable': 33, 'notselected': 246, 'pass': 355}
pass rate: 98.6%

Your own report is at /tmp/cis-check-report.html. As you install software and change settings, re-run this to see how your changes affect the result.

Why the command reads /usr/share/cloudimg/openscap/ssg-split/. Some rules (the ufw and nftables rules, and the file ownership checks) are small shell scripts inside the SCAP content. The OpenSCAP 1.2 scanner in Ubuntu 22.04 unpacks a data stream's scripts into /tmp and runs them from there, which noexec on /tmp refuses. The image therefore ships the same pinned SCAP Security Guide content already unpacked into /usr/share/cloudimg/openscap/ssg-split/, where the scripts can run, and the build used it too. If you evaluate the data stream file /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml directly instead, those seven script-checked rules report error rather than pass or fail.

Step 7: Confirm IMDSv2 is required

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401
us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2; every current AWS SDK and the AWS CLI do this automatically.

Step 8: The host firewall and listening ports

sudo ufw status verbose
sudo ss -tlnp

Expected output:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
Anywhere on lo             ALLOW IN    Anywhere                  
22/tcp                     ALLOW IN    Anywhere                  
68/udp                     ALLOW IN    67/udp                     # DHCP client: replies from a DHCP server (port 67)
Anywhere                   DENY IN     127.0.0.0/8               
Anywhere (v6) on lo        ALLOW IN    Anywhere (v6)             
22/tcp (v6)                ALLOW IN    Anywhere (v6)             
Anywhere (v6)              DENY IN     ::1                       

Anywhere                   ALLOW OUT   Anywhere on lo            
Anywhere (v6)              ALLOW OUT   Anywhere (v6) on lo       

State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess                                   
LISTEN 0      100        127.0.0.1:25        0.0.0.0:*    users:(("master",pid=1415,fd=13))        
LISTEN 0      4096   127.0.0.53%lo:53        0.0.0.0:*    users:(("systemd-resolve",pid=677,fd=14))
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*    users:(("sshd",pid=915,fd=3))            
LISTEN 0      100            [::1]:25           [::]:*    users:(("master",pid=1415,fd=14))        
LISTEN 0      128             [::]:22           [::]:*    users:(("sshd",pid=915,fd=4))            

Only sshd listens on the network. The DNS stub resolver (53) and the local mail relay (25, for system mail) listen on loopback only. The 68/udp rule admits only the replies a DHCP server sends from port 67 to the instance's DHCP client, which keeps its address; it opens no service.

Opening a port for your own service takes two steps: allow it in the instance's security group, and allow it in ufw. For example, for a web server on 443, run on the instance:

sudo ufw allow 443/tcp

If a port is open in the security group but not in ufw (or the other way round), the traffic will not arrive.

Step 9: Time sync and the Systems Manager agent

systemctl is-active chrony amazon-ssm-agent
chronyc -n sources | head -6
dpkg -s snapd >/dev/null 2>&1 && echo "snapd: installed" || echo "snapd: not installed"

Expected output (the pool servers and timings vary):

active
active
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^* 169.254.169.123               3   4   377     3  -6831ns[  -12us] +/-  391us
^- 91.189.91.157                 2   6   377    19    +36us[  +29us] +/-   28ms
^- 185.125.190.56                2   6   377    20  -3450us[-3457us] +/-   44ms
^- 185.125.190.58                2   6   377    21  -3014us[-3020us] +/-   44ms
snapd: not installed

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public Ubuntu pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's Debian package rather than as a snap, and snapd is removed.

Step 10: Patch level and automatic updates

The image is fully patched at build time. Check what is pending now:

sudo apt-get update -qq
apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | awk '/^Inst /{n++} END{print "pending upgrades: " n+0}'
apt-mark showhold
uname -r

Expected output on an instance launched soon after the image was built (later launches show the updates released since):

pending upgrades: 0
6.8.0-1066-aws

unattended-upgrades is on, so security updates install automatically every day. To update everything now, run:

sudo apt-get update && sudo apt-get -y dist-upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

Package installs work normally with /tmp mounted noexec: the image points apt's template extraction at /var/cache/apt/extract-tmp, so package configuration scripts still run.

Step 11: Security settings on the instance

sudo aa-status --enabled && echo "apparmor: enabled"
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval) '
cat /etc/issue.net

Expected output:

apparmor: enabled
root L 10/14/2026 0 99999 7 -1
maxauthtries 4
clientaliveinterval 300
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
Authorized users only. All activity may be monitored and reported.

• L means the root password is locked.
• maxauthtries 4 and clientaliveinterval 300 come from the CIS profile: SSH allows four authentication attempts per connection and checks idle sessions every five minutes.
• The banner text is shown before login.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. If you want serial console access, set a password for your own user on your running instance (the password is yours and is not on the image):

sudo passwd ubuntu

Step 12: Growing a volume, swap and file integrity

sudo vgs ubuntu-vg
df -h / /var /var/log
sudo grep -E "cc_growpart.py.*(SKIPPED|resized|NOCHANGE)" /var/log/cloud-init.log | tail -1 | cut -c1-140
swapon --noheadings --show | wc -l
sudo ls -l /etc/cron.daily/aide

Expected output with the default 12 GiB root volume:

  VG        #PV #LV #SN Attr   VSize  VFree  
  ubuntu-vg   1   7   0 wz--n- 10.80g 820.00m
Filesystem                      Size  Used Avail Use% Mounted on
/dev/mapper/ubuntu--vg-root     3.9G  1.3G  2.4G  36% /
/dev/mapper/ubuntu--vg-var      1.5G  597M  786M  44% /var
/dev/mapper/ubuntu--vg-var_log  974M   18M  889M   2% /var/log
2026-10-18 22:48:44,533 - cc_growpart.py[DEBUG]: '/' SKIPPED: Resizing mapped device (/dev/mapper/ubuntu--vg-root) skipped as it is not encr
0
-rwxr-xr-x 1 root root 34194 Dec 30  2021 /etc/cron.daily/aide

cloud-init does not grow LVM volumes. On a plain Ubuntu image cloud-init grows the root filesystem to the volume size on first boot. On this image the root filesystem is a logical volume, so cloud-init skips it (the SKIPPED line above). That is deliberate: you decide which volume gets the space. When you launch with a bigger root volume, or grow the EBS volume later with aws ec2 modify-volume, add the space in three steps on the instance:

1. Grow partition 4 (the LVM physical volume) to the end of the disk, and tell LVM:

sudo growpart /dev/nvme0n1 4
sudo pvresize /dev/nvme0n1p4

1. Give space to the volumes that need it. --resizefs grows the filesystem in the same step, online, with no reboot:

sudo lvextend --resizefs -L +4G /dev/ubuntu-vg/root
sudo lvextend --resizefs -L +2G /dev/ubuntu-vg/var

1. Check the result:

sudo vgs ubuntu-vg
df -h / /var

Example output after launching with a 20 GiB root volume and running the commands above:

CHANGED: partition=4 start=2510848 old: size=22654943 end=25165791 new: size=39432159 end=41943007
  Physical volume "/dev/nvme0n1p4" changed
  1 physical volume(s) resized or updated / 0 physical volume(s) not resized
  Size of logical volume ubuntu-vg/root changed from 4.00 GiB (1024 extents) to 8.00 GiB (2048 extents).
  Logical volume ubuntu-vg/root successfully resized.
resize2fs 1.46.5 (30-Dec-2021)
Filesystem at /dev/mapper/ubuntu--vg-root is mounted on /; on-line resizing required
old_desc_blocks = 1, new_desc_blocks = 1
The filesystem on /dev/mapper/ubuntu--vg-root is now 2097152 (4k) blocks long.

  Size of logical volume ubuntu-vg/var changed from 1.50 GiB (384 extents) to 3.50 GiB (896 extents).
  Logical volume ubuntu-vg/var successfully resized.
resize2fs 1.46.5 (30-Dec-2021)
Filesystem at /dev/mapper/ubuntu--vg-var is mounted on /var; on-line resizing required
old_desc_blocks = 1, new_desc_blocks = 1
The filesystem on /dev/mapper/ubuntu--vg-var is now 917504 (4k) blocks long.

  VG        #PV #LV #SN Attr   VSize  VFree
  ubuntu-vg   1   7   0 wz--n- 18.80g 2.80g
Filesystem                   Size  Used Avail Use% Mounted on
/dev/mapper/ubuntu--vg-root  7.8G  1.3G  6.2G  18% /
/dev/mapper/ubuntu--vg-var   3.5G  532M  2.8G  17% /var

To give a volume all the remaining free space instead, use -l +100%FREE, for example sudo lvextend --resizefs -l +100%FREE /dev/ubuntu-vg/var_log. Leaving some space unallocated is useful: you can grow whichever volume fills first without touching EBS. Volumes can grow online but not shrink online, so add space in steps.

• Swap. The image has no swap. If your workload needs it, create a logical volume for it (for example sudo lvcreate -L 2G -n swap ubuntu-vg, then mkswap and an /etc/fstab entry), or a swap file on / or /var.
• AIDE. The file integrity database is built from the image's own files, and a daily check runs from /etc/cron.daily/aide.

Step 13: Install software and add users

The instance uses the standard Ubuntu archives:

sudo apt-get update -qq
apt-cache policy nginx | sed -n '1,3p'

Expected output (the version changes over time):

nginx:
  Installed: (none)
  Candidate: 1.18.0-6ubuntu14.21

Install and start software in the usual way, for example sudo apt-get install -y nginx then sudo systemctl enable --now nginx, and open its port in the security group and ufw (Step 8). Application data under /var (databases in /var/lib, web roots in /var/www) lands on the var logical volume, so grow that volume (Step 12) before you load large data sets.

Scripts in /tmp. Because /tmp and /var/tmp are noexec, a downloaded installer saved there cannot be run as ./installer.sh. Run it through its interpreter instead, or save it in your home directory or /opt first:

printf '#!/bin/sh\necho hello from /tmp\n' > /tmp/noexec-test.sh && chmod +x /tmp/noexec-test.sh
/tmp/noexec-test.sh || echo "exit code $? (noexec)"
bash /tmp/noexec-test.sh
rm -f /tmp/noexec-test.sh

Expected output:

bash: /tmp/noexec-test.sh: Permission denied
exit code 126 (noexec)
hello from /tmp

To add another administrator, create the account, add it to the sudo group and give it an SSH key:

sudo adduser --disabled-password --gecos "" alice
sudo usermod -aG sudo alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh
echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys

Because SSH is key-only, a new account needs its key in authorized_keys. The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice. SSH stays key-only; the password is used by sudo. (Only ubuntu, created by cloud-init, has password-free sudo.)

Common use cases

• Workloads that must show CIS Level 1 alignment including the separate partition rules, with the evaluation report already on the machine
• Servers whose logs, audit trail or temporary files must not be able to fill the root filesystem
• Database and application hosts where /var grows independently of the operating system
• A starting point for your own golden image: add your software, re-run Step 6, and keep the report with your build

Troubleshooting

SSH says "Too many authentication failures"

The SSH server allows four authentication attempts per connection. If your SSH agent holds several keys, it can use them up before it offers the right one. Tell SSH to offer only the key you name:

ssh -o IdentitiesOnly=yes -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

Cannot connect via SSH

1. Check the instance is running and has passed its status checks.
2. Check the security group allows TCP 22 from your current public address.
3. Use the user name ubuntu and the key pair chosen at launch. Password login is disabled, so a wrong key never falls back to a password prompt.
4. If you changed ufw, make sure 22/tcp is still allowed. Session Manager (Step 2) still works if SSH is blocked, provided the instance has a Systems Manager instance profile.

I launched with a bigger volume but df shows the same size

That is expected on this image: cloud-init does not grow logical volumes. Follow Step 12 to grow the physical volume and then the logical volumes you choose.

A volume is full

Check which one with df -h. If the volume group has free space (sudo vgs), grow the full volume with lvextend --resizefs (Step 12). If not, grow the EBS volume first with aws ec2 modify-volume or the console, then run the three steps in Step 12.

"Permission denied" running a script or binary

/tmp, /var/tmp, /var/log and /var/log/audit are mounted noexec. Run scripts through their interpreter (bash script.sh) or move them to your home directory or /opt.

The compliance evaluation reports rules as "error"

Evaluate the unpacked content in /usr/share/cloudimg/openscap/ssg-split/ as shown in Step 6, not the data stream file. The scanner cannot run the content's check scripts from the noexec /tmp.

My service is running but not reachable

Allow the port in both the security group and ufw (Step 8). sudo ufw status shows the ufw rules; sudo ss -tlnp shows whether the service listens on all addresses or only on loopback.

A tool that uses instance metadata fails

The image requires IMDSv2. Old scripts that call http://169.254.169.254/ without a token get HTTP 401. Update them to request a token first (Step 7), or use the AWS CLI or a current SDK.

Package manager issues

Refresh the package lists first:

sudo apt-get update

If the archives are unreachable, check that the instance has outbound internet access (a public IP or a NAT gateway) and that DNS resolves:

getent hosts archive.ubuntu.com

Important notes

Ubuntu is free and open source software. It is a distribution of thousands of packages, each under its own licence (GPL, LGPL, MIT, BSD, Apache 2.0 and others); each package's terms are in /usr/share/doc/<package>/copyright. No subscription or licence key is needed to run this image. The compliance tooling is OpenSCAP (LGPL 2.1 or later) and SCAP Security Guide content (BSD 3-Clause, licence text in /usr/share/doc/cloudimg/scap-security-guide-LICENSE.txt).

Ubuntu 22.04 LTS receives standard security maintenance until 2027.

The CIS Level 1 Server profile used here is the OpenSCAP profile published in SCAP Security Guide. These images are not CIS Hardened Images and are not certified by the Center for Internet Security. A pass rate measures this image as built; your own changes affect it, which is why the evaluation can be re-run (Step 6).

Ubuntu is a trademark of Canonical Ltd. CIS is a trademark of the Center for Internet Security. Both names are used only to identify the software and the profile. cloudimg is not affiliated with or endorsed by Canonical Ltd or the Center for Internet Security.

Support

For help with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• User Guides: www.cloudimg.co.uk/guides
• Ubuntu on AWS hub: www.cloudimg.co.uk/guides/ubuntu-server-aws