Farallon Labs Hardened Image CIS Level 1 on Rocky Linux 9

The Farallon Labs Hardened Image CIS Level 1 is a pre-configured, security-hardened image built by Farallon Labs LLC for use on EC2. It is a pre-configured, security-hardened image that aligns with the CIS Benchmark, Level 1 - Server profile, making it easier for organizations to meet regulatory requirements.

The image is rebuilt within 24 hours of when the upstream base AMI is updated, so it stays current with vendor security patches and base image changes.

This image is hardened against the Level 1 profile, which is intended to be practical and prudent, provide a clear security benefit, and not inhibit the utility of the technology beyond acceptable means.

To demonstrate conformance to the applicable CIS Benchmark, each image includes a set of compliance and validation artifacts. Farallon Labs includes these artifacts on the instance itself so that customers and auditors can independently verify the hardening state without relying on external claims. Each Farallon Labs Hardened Image contains the following files:

openscap_report_before_hardening.html - this provides a printable human-readable report of the OpenSCAP scan run against the instance before any hardening is applied. It shows the baseline compliance state of the unhardened base AMI.

openscap_report_after_hardening.html - this provides a printable human-readable report of the OpenSCAP scan run against the instance after the CIS Benchmark was applied. It shows the compliance state of the hardened image, including pass, fail, and not-applicable results per rule.

openscap_results_before_hardening.xml - this provides the machine-readable XCCDF results from the OpenSCAP scan run against the instance before any hardening is applied. It is the raw output that scoring tools and CI systems consume.

openscap_results_after_hardening.xml - this provides the machine-readable XCCDF results from the OpenSCAP scan run against the instance after the CIS Benchmark was applied. It is the primary compliance evidence for the final image.

packages_dnf_before_hardening.txt - this provides a list of the packages resident on the instance prior to any hardening, as reported by the dnf package manager.

packages_dnf_after_hardening.txt - this provides a list of the packages resident on the instance after the CIS Benchmark was applied, as reported by the dnf package manager.

packages_rpm_before_hardening.txt - this provides the detailed package inventory (name, version, release, architecture) of the instance prior to any hardening, as reported by rpm.

packages_rpm_after_hardening.txt - this provides the detailed package inventory of the instance after the CIS Benchmark was applied, as reported by rpm.

exceptions_and_exclusions.md - this provides a list of every Level 1 rule that did not pass outright in the final after-hardening scan. It includes rules that failed, rules that were determined not to apply to this system, and rules that were intentionally excluded from scoring because the configuration of those recommendations may inhibit the use of this image, require environment-specific expertise, or hinder the integration of this image. Each excluded rule is grouped by its rationale category so the reason for the exclusion is transparent.

exceptions_and_exclusions.html - this provides a self-contained HTML version of the same exceptions and exclusions report.

system_validation_report.html - this provides a before/after comparison report that surfaces any functional regressions introduced by hardening. It shows each test side by side with its before and after status, and highlights any new failures.

These reports are located in /home/compliance_reports. Access requires root privileges.

To learn more about the hardening definition used for this image, please visit https://github.com/ComplianceAsCode/content .