Hardened Ubuntu 22.04, 24.04 & 26.04 LTS : Minimal, LVM, STIG

This is a repackaged open source software product wherein additional charges apply for security hardening, secure-by-default configuration and per-instance setup.

Deploy hardened Ubuntu instances on EC2 without building your own hardening pipeline. Every AMI boots secure by default: key-only SSH authentication with no default passwords, unique SSH host keys and machine ID generated on each instance's first boot, and the compliance evidence on the instance.

Why use pre-hardened AMIs

• Reduce time to compliance: skip applying the CIS Level 1 Server or STIG profile to stock Ubuntu yourself; each instance starts already remediated, with its remaining findings documented.
• A consistent baseline: every AMI is rebuilt from the official upstream image with automated remediation, so every instance starts from the same hardened configuration.
• Simpler audit preparation: when you run OpenSCAP against your fleet, instances start from a measured, hardened baseline and the build-time report is already on each one.
• Fits automated workflows: use these AMIs as the base image in infrastructure-as-code, CI/CD pipelines and Auto Scaling groups so every new instance inherits the same configuration.

What cloudimg adds to every version

• Built from the official Ubuntu cloud image, fully patched at build time and remediated with the OpenSCAP CIS Level 1 Server profile (SCAP Security Guide). STIG-Hardened variants apply the OpenSCAP STIG profile instead.
• Measured on each image as built: the pass rate is in every version's release notes (98% or more of scored rules on the CIS images built so far), and the full HTML report and the reason for each waived rule ship on the instance under /usr/share/doc/cloudimg/.
• Unique SSH host keys and machine ID generated on every instance's first boot; key-only SSH as ubuntu, root locked, no default passwords, and no build residue or shared keys.
• Hardened for EC2: IMDSv2 required, chrony on Amazon Time Sync, unattended security updates enabled, cloud-init and current kernels.

Included products

• Ubuntu 22.04 LTS Arm64
• Ubuntu 22.04 LTS LVM
• Ubuntu 22.04 LTS Minimal
• Ubuntu 22.04 LTS STIG-Hardened
• Ubuntu 24.04 LTS Arm64
• Ubuntu 24.04 LTS LVM
• Ubuntu 24.04 LTS Minimal
• Ubuntu 26.04 LTS Arm64
• Ubuntu 26.04 LTS LVM
• Ubuntu 26.04 LTS Minimal
• Ubuntu 26.04 LTS Networking Tools
• Ubuntu 26.04 LTS Sysadmin Tools
• Ubuntu Server 22.04 LTS
• Ubuntu Server 24.04 LTS
• Ubuntu Server 26.04 LTS

How to choose a version

• Standard: the full server image with the CIS Level 1 Server profile, for general-purpose workloads.
• Minimal: fewer installed packages and a smaller attack surface, for security-sensitive or single-purpose servers.
• LVM: the root filesystem on LVM, so volumes can grow without repartitioning.
• STIG: remediated with the OpenSCAP DISA STIG profile instead of CIS Level 1, where your requirements call for STIG alignment. It applies the open-source profile; it is not a DISA certification.
• Arm64: the standard image for AWS Graviton (arm64) instance types.
• Networking Tools and Sysadmin Tools (26.04 LTS): the standard image with a set of Ubuntu archive networking or system administration tools preinstalled.

Network and access defaults

• Host firewall enabled (ufw) with inbound SSH only: open application ports in both the EC2 security group and ufw.
• Key-only SSH authentication as the ubuntu user; password login is disabled.

Build process

Every image follows the same pipeline: start from the official Ubuntu cloud image, apply every available update, run the OpenSCAP profile (CIS Level 1 Server or STIG) for automated remediation, apply the EC2 hardening above, measure the result, and remove all build credentials and residue before the AMI is captured. Ubuntu 26.04 LTS versions are remediated and scored the same way when they are built.

Getting started

1. Subscribe to this listing (a free trial is available).

2. Choose the Ubuntu release and variant from the Software version list.

3. Launch with the EC2 console, the AWS CLI or your infrastructure-as-code tool; m5.large is recommended.

4. Connect over SSH as ubuntu with your EC2 key pair.

5. Open any application ports in both the security group and ufw.

This listing is a collection of separate AMIs, one per release and variant, chosen from the Software version dropdown at launch.

Support

cloudimg provides 24/7 technical support for every version in this listing by email and live chat, 365 days a year, with a 24-hour response SLA: support@cloudimg.co.uk.

Trademarks

Ubuntu is a registered trademark of Canonical Ltd. CIS and CIS Benchmarks are trademarks of the Center for Internet Security, Inc. cloudimg is not affiliated with or endorsed by Canonical or CIS, and these images are not CIS Hardened Images.