Hardened PostgreSQL-16 on Rocky Linux 9

This is a repackaged open source software product wherein additional charges apply for a pre-hardened, AWS-optimized image with verifiable compliance evidence and maintenance. PostgreSQL 16 runs on a Rocky Linux 9.8 base hardened following DISA STIG guidelines, tuned for Amazon EC2 workloads, and shipped with a complete OpenSCAP evidence pack and Software Bill of Materials (SBOM).

PostgreSQL 16 Deployment:

1. Best-Practice Deployment: PostgreSQL 16 installed and enabled following official AWS and PostgreSQL guidelines, ready to accept connections on first launch.

2. Secure Defaults, Zero Configuration Drift: The upstream default peer authentication is preserved and network access is restricted to localhost, so the database is never exposed to the public internet by accident.

3. Bloat-Free Data Layer: CPU and memory go to query planning and transaction processing rather than unused system services.

Hardened Operating System Base:

1. DISA STIG Alignment: 339 security controls applied to the Rocky Linux 9.8 base via the SCAP Security Guide, including auditd logging, SSH hardening, kernel command line and module blocklist restrictions, and strict password policy enforcement.

2. Fully Patched at Release: Zero packages with a pending update at build time, verified. The complete CVE scan ships inside the image.

3. Documented Exceptions: Every STIG rule not applied is itemized with a technical justification, so the delivered posture is auditable.

Comprehensive Evidence Pack:

Every AMI carries an OpenSCAP evidence pack generated against DISA STIG guidance, under /opt/hardening-report/:

• Base_Report.html: Pre-hardening scan report, the initial baseline.
• Tailored_Profile_Report.html: Post-hardening report against the tailored profile shipped in this image.
• Raw_STIG_Report.html: Post-hardening report against the unmodified baseline DISA STIG profile.
• Exceptions.txt: Itemized unapplied STIG rules with technical justifications (AWS compatibility, site-specific policies, CSP service conflicts).
• Tuning_Parameters.txt: Every tuning parameter applied on top of the hardening, each shown against its base-image value.
• compliance_mapping.csv: Rule-by-rule mapping to NIST SP 800-53 controls and DISA STIG identifiers with pass/fail statuses.
• package_changes.txt: Package delta against the minimal stock installation.
• sbom.spdx.json: Software Bill of Materials in SPDX format, generated from the RPM database.
• cve_scan.txt / cve_scan_full.txt.gz: Vulnerability scan reports categorizing CVEs by upstream patch availability.
• key_files.sha256: SHA-256 checksums of the key configuration files changed by the hardening, so the delivered state can be verified.
• README.txt: Index of artifact contents, operational guidelines, and configuration defaults.

Reliability Validation:

1. Validation Testing: Functional verification on clean AMI launches through multi-round integration testing, covering the complete database lifecycle with SELinux enforcing.

AWS Network & Kernel Tuning:

1. Network Stack: TCP BBR congestion control with fair queueing, increased connection backlogs, buffer adjustments, and MTU probing enabled.

2. System Tuning: Red Hat tuned daemon active with a custom cloud profile, transparent hugepages set to madvise, and modified memory/EBS writeback parameters.

3. EC2 Integration: NVMe I/O timeouts, Amazon Time Sync (chrony), IRQ balance daemon, and size-capped persistent journald logging.

Operational Tools:

1. Preinstalled Tools: AWS SSM Session Manager enabled, CloudWatch Agent installed (disabled by default).

Maintenance:

1. Maintenance Specifications: Rebuilt and updated bi-weekly to monthly incorporating upstream PostgreSQL and Rocky Linux 9.8 security updates, with artifact documentation refreshed per release.

About PostgreSQL 16

One of the world's most advanced open-source relational database systems, known for strict ACID compliance, a rich SQL feature set, and deep extensibility through JSONB, full text search, and foreign data wrappers. Version 16 improves parallel query execution and logical replication, serving transactional and analytical workloads alike, and integrates with ORM layers such as Hibernate and SQLAlchemy and frameworks including Django and FastAPI.

About Rocky Linux 9

Built directly from RHEL 9 source code for binary compatibility with the Red Hat 9 ecosystem, with predictable update cadences and a maintenance lifecycle through 2032. Any application compiled, certified, or documented for RHEL 9 runs without modification, and the platform is structurally aligned with AlmaLinux, CentOS Stream, and legacy CentOS deployments.