AIDE File Integrity Monitor - Host-Based FIM

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## AIDE File Integrity Monitor - Ready-to-Run AMI by cloudimg

AIDE (Advanced Intrusion Detection Environment) is the open-source, GPL-2.0 licensed host-based file and directory integrity checker. This AMI delivers AIDE fully configured as a ready-to-run integrity-monitoring appliance - SSH in and the baseline and scheduled check are already in place.

AIDE builds a cryptographic baseline database of file attributes - permissions, ownership, inode, size, timestamps and content hashes - and on every subsequent run reports exactly what has been added, removed or changed. It is a host intrusion detection staple and a direct answer to compliance controls that mandate file-integrity monitoring, such as PCI-DSS requirement 11.5 and the CIS Benchmarks.

## Why Choose This AMI Over Self-Installation

Standing AIDE up correctly is more subtle than installing a package: the baseline must be built on the real machine, the monitored scope must be tuned so the daily check is meaningful without drowning in noise, and the schedule and reporting must be wired up. This AMI handles all of it:

• Per-instance baseline, built at first boot - The baseline database is never baked into the image. It is generated on your instance at first boot so it fingerprints your real machine, not the build server.
• Focused, hardened monitored scope - Executables, libraries, boot, kernel modules and /etc are watched out of the box, with volatile paths excluded so the report stays signal, not noise.
• Scheduled and logged - A systemd timer runs a daily integrity check and writes the diff report to /var/log/aide, ready for your log pipeline or SIEM.
• Fail-closed by design - The scheduled check refuses to run unless a valid per-instance baseline is present, so a silent no-baseline state can never masquerade as a clean result.

## How File-Integrity Monitoring Works Here

• On first boot, AIDE initializes a baseline database describing your instance's monitored files
• A daily systemd timer runs an integrity check against that baseline
• The check reports every added, removed or changed file to /var/log/aide
• After intentional, reviewed changes (a package update, a config edit) you update the baseline with aideinit or aide --update
• There is no daemon, no network port and no credential - AIDE is a purely local command-line tool

## Getting Started

1. Launch the AMI on your preferred EC2 instance type

2. Connect over SSH using your key pair

3. Confirm the per-instance baseline built at first boot with sudo aide --check --config=/etc/aide/aide.conf

4. Review the daily report at /var/log/aide/aide.log

5. After any intentional change, refresh the baseline with sudo aideinit

## Use Cases

• Compliance file-integrity monitoring - Satisfy PCI-DSS 11.5, CIS and similar controls that mandate FIM
• Host intrusion detection - Detect tampering of system binaries, libraries and configuration
• Change auditing - Get a reviewable daily record of what changed on a server
• Golden-image drift detection - Confirm a fleet instance still matches its intended state

## Security Practices

AIDE is installed unmodified from the operating system's official package archive, so it is covered by standard unattended security updates. The baseline database is generated per instance and stored read-restricted; for real tamper assurance, move a copy of the baseline off the instance or to read-only media. SSH access uses key-based authentication. AIDE opens no network socket and runs no daemon.

## About cloudimg

cloudimg provides pre-configured, production-ready AMIs with expert 24/7 support. Critical issues receive a one-hour average response. Support covers baseline initialization, tuning the monitored scope, interpreting integrity reports, wiring reports into your log pipeline, and moving the baseline off-box for stronger tamper assurance.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.