OpenSCAP - SCAP Compliance and Vulnerability Scanner

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## OpenSCAP Compliance and Vulnerability Scanner

Deploy a ready-to-run SCAP compliance scanner on your own EC2 instance within minutes. Built on OpenSCAP - the reference open source implementation of the Security Content Automation Protocol - this AMI pairs the oscap engine with the SCAP Security Guide content so it can audit the operating system it runs on against real CIS and DISA STIG benchmarks, out of the box, with no manual content assembly.

## Why This Scanner Instead of Alternatives

• No per-scan or per-asset fees - Unlike SaaS compliance platforms that charge per scan or per node, this AMI runs on hardware you control with predictable costs
• No agents to deploy - Unlike fleet-based scanners requiring installation on every target, one instance can scan remote hosts over SSH without touching them
• Upstream-verified content - Unlike distribution-packaged SCAP guides that often lag behind the OS release, this image ships the current ComplianceAsCode content verified against its published checksum
• No vendor lock-in - Standard SCAP outputs (HTML and ARF) integrate with any GRC tool or evidence repository

## What This Image Is, Stated Plainly

This is a compliance SCANNER, not a compliance suite. It measures and reports: it evaluates your instance against a chosen policy profile and produces a human-readable HTML report plus a machine-readable ARF results file for your records. It does not have a web console, a fleet inventory, or historical trending, and it does not make any machine compliant on its own. What it does, it does honestly and out of the box - and for a single-node audit and drift-detection appliance that is exactly the useful shape.

## Audits the OS It Runs On

This image installs the upstream ComplianceAsCode content release, verified against its published checksum, and ships the matching datastream with six profiles - CIS Level 1 and Level 2 for server and workstation, DISA STIG, and the standard profile. A baseline scan runs automatically on first boot.

## Scheduled Drift Detection

A systemd timer re-runs your chosen profile on a schedule and keeps dated reports, so you can see your compliance posture drift over time. The profile and retention are set in a single config file. The scheduled scan is audit only - it never applies a fix.

## Scan Remote Hosts

Using oscap-ssh and your own SSH key, one appliance can evaluate other Linux hosts over the network from this instance, so a small estate can be audited from a single scanner. All remote scanning is outbound - nothing listens on this instance beyond SSH.

## Generate Remediation for Review

When a scan reports failures, oscap xccdf generate fix emits bash or Ansible scoped to your own results, for you to review and apply deliberately. The upstream remediation scripts and playbooks for every shipped profile are installed for reference. Remediation is never run automatically - CIS Level 2 and STIG hardening can disable services and lock an instance down, so it is always a reviewed, deliberate act.

## Fail-Closed by Design

This image verifies the integrity of its policy content before every scheduled scan - the datastream must be present, unaltered against its recorded checksum, and accepted by the scanner - and a failed first boot stops the scheduled scan rather than reporting a clean result from missing content.

## Minimal Attack Surface

OpenSCAP binds no port and runs no daemon. The only listening service is SSH for administration. There is no login and no baked-in credential of any kind: the scanner is operated entirely from the command line with your own SSH key.

## Get Started with a Guided Setup

Want help choosing the right profile, scheduling scans, or wiring reports into your evidence workflow? Contact cloudimg for a free guided setup session. Our engineers will walk you through profile selection, remote scanning, and remediation review so you reach a repeatable audit process faster.

## Use Cases

• Continuous configuration audit - Run a CIS or STIG scan automatically on first boot and on a schedule, keeping dated evidence of your instance's compliance posture over time
• Audit evidence generation - Produce HTML and machine-readable ARF reports to support security reviews and regulatory attestation in regulated environments
• Small-estate scanning - Evaluate a handful of Linux hosts over SSH from a single scanner using your own key, without installing an agent on each target