AlmaLinux on AlmaLinux 8

This is a repackaged open source software product wherein additional charges apply for security hardening, secure-by-default configuration and per-instance setup.

Deploy hardened AlmaLinux instances on EC2 without building your own hardening pipeline. AlmaLinux is a community-owned, open source enterprise Linux distribution. Every AMI in this listing boots with key-only SSH, no default passwords, unique SSH host keys generated on first boot, and compliance evidence included on the instance.

Why use pre-hardened AMIs

• Reduce time to compliance: each instance starts already remediated with the CIS Level 1 Server, STIG or Essential Eight profile, with remaining findings documented.
• A consistent baseline: every AMI is rebuilt from the official upstream image with automated remediation, so every instance starts from the same known-good configuration.
• Simpler audits: instances launch from a measured baseline with the build-time OpenSCAP report included on each one, ready for your auditors to review.

What cloudimg adds to every version

• Built from the official AlmaLinux image, fully patched at build time and remediated with the OpenSCAP CIS Level 1 Server profile (SCAP Security Guide). STIG and Essential Eight variants apply the OpenSCAP DISA STIG or ACSC Essential Eight profile instead.
• Measured on each image as built: the pass rate is published in every version's release notes (98% or more of scored rules on the CIS images), and the full HTML report plus the reason for each waived rule ship on the instance under /usr/share/doc/cloudimg/.
• Unique SSH host keys and machine ID generated on every instance's first boot. Root is locked, there are no default passwords, and no build residue or shared keys.
• Hardened for EC2: IMDSv2 required, SELinux enforcing, chrony on Amazon Time Sync, automatic security updates with dnf-automatic, an AIDE file-integrity database on the CIS and STIG images, cloud-init and current kernels.

Included products

• AlmaLinux 10 LVM
• AlmaLinux 10 Minimal
• AlmaLinux 10.2
• AlmaLinux 8 LVM
• AlmaLinux 8 Minimal
• AlmaLinux 8.10
• AlmaLinux 9 Essential Eight
• AlmaLinux 9 LVM
• AlmaLinux 9 Minimal
• AlmaLinux 9 STIG
• AlmaLinux 9.8

How to choose a version

• Standard (AlmaLinux 8.10, 9.8 and 10.2): the full server image with the CIS Level 1 Server profile, for general-purpose workloads.
• Minimal: fewer installed packages and a smaller attack surface, for security-sensitive or single-purpose servers.
• LVM: the root filesystem on LVM, so volumes can grow without repartitioning.
• STIG (AlmaLinux 9): the OpenSCAP DISA STIG profile instead of CIS Level 1, where you need STIG alignment. It is not a DISA certification.
• Essential Eight (AlmaLinux 9): the OpenSCAP ACSC Essential Eight profile. It is not an ACSC assessment.
• Release: AlmaLinux 10 for new deployments, 9 for the widest choice of hardening profiles, 8 for applications that still need EL8.

Network and access defaults

• Host firewall enabled (firewalld) with inbound SSH only: open application ports in both the EC2 security group and firewalld.
• Key-only SSH authentication as ec2-user; password login is disabled and root login is refused.

Build process

Every image follows the same pipeline: start from the official AlmaLinux image, apply every available update, run the OpenSCAP profile (CIS Level 1 Server, STIG or Essential Eight) twice for automated remediation, reboot, apply the EC2 hardening above, measure the result with a scored OpenSCAP evaluation, and remove all build credentials and residue (including wiping free disk space) before the AMI is captured.

Getting started

1. Subscribe to this listing (a free trial is available).

2. Choose the AlmaLinux release and variant from the Software version list.

3. Launch with the EC2 console, the AWS CLI or your infrastructure-as-code tool; m5.large is recommended.

4. Connect over SSH as ec2-user with your EC2 key pair.

5. Review the compliance report under /usr/share/doc/cloudimg/ to verify the hardening baseline.

6. Open any application ports in both the security group and firewalld.

This listing is a collection of separate AMIs, one per release and variant, chosen from the Software version dropdown at launch.

Support

cloudimg provides 24/7 technical support for every version in this listing by email and live chat, 365 days a year, with a 24-hour response SLA: support@cloudimg.co.uk.

Trademarks

AlmaLinux is a trademark of the AlmaLinux OS Foundation; these images are derived from AlmaLinux OS. CIS and CIS Benchmarks are trademarks of the Center for Internet Security, Inc. cloudimg is not affiliated with or endorsed by the AlmaLinux OS Foundation or CIS, and these images are not CIS Hardened Images.