Hardened OpenSearch on Rocky Linux 9

This is a repackaged open source software product wherein additional charges apply for a pre-hardened, AWS-optimized image with verifiable compliance evidence and maintenance. OpenSearch runs on a Rocky Linux 9.8 base hardened following DISA STIG guidelines, tuned for Amazon EC2 workloads, and shipped with a complete OpenSCAP evidence pack and Software Bill of Materials (SBOM).

OpenSearch Deployment:

1. Secure by Default: The built-in Security plugin is enabled out of the box with TLS-encrypted REST API access and a unique per-instance administrator password, so the cluster starts in a secured state rather than an open one.

2. Tuned for the Storage Engine: Kernel parameters including vm.max_map_count are already tuned for the memory-mapped storage engine, and network access is restricted to localhost by default.

3. Best-Practice Deployment: Installed and enabled following official AWS and OpenSearch guidelines, ready to serve indexing and query traffic on first launch.

Hardened Operating System Base:

1. DISA STIG Alignment: 339 security controls applied to the Rocky Linux 9.8 base via the SCAP Security Guide, including auditd logging, SSH hardening, kernel command line and module blocklist restrictions, and strict password policy enforcement.

2. Fully Patched at Release: Zero packages with a pending update at build time, verified. The complete CVE scan ships inside the image.

3. Documented Exceptions: Every STIG rule not applied is itemized with a technical justification, so the delivered posture is auditable.

Comprehensive Evidence Pack:

Every AMI carries an OpenSCAP evidence pack generated against DISA STIG guidance, under /opt/hardening-report/:

• Base_Report.html: Pre-hardening scan report, the initial baseline.
• Tailored_Profile_Report.html: Post-hardening report against the tailored profile shipped in this image.
• Raw_STIG_Report.html: Post-hardening report against the unmodified baseline DISA STIG profile.
• Exceptions.txt: Itemized unapplied STIG rules with technical justifications (AWS compatibility, site-specific policies, CSP service conflicts).
• Tuning_Parameters.txt: Every tuning parameter applied on top of the hardening, each shown against its base-image value.
• compliance_mapping.csv: Rule-by-rule mapping to NIST SP 800-53 controls and DISA STIG identifiers with pass/fail statuses.
• package_changes.txt: Package delta against the minimal stock installation.
• sbom.spdx.json: Software Bill of Materials in SPDX format, generated from the RPM database.
• cve_scan.txt / cve_scan_full.txt.gz: Vulnerability scan reports categorizing CVEs by upstream patch availability.
• key_files.sha256: SHA-256 checksums of the key configuration files changed by the hardening, so the delivered state can be verified.
• README.txt: Index of artifact contents, operational guidelines, and configuration defaults.

Reliability Validation:

1. Validation Testing: Functional verification on clean AMI launches through multi-round integration testing, covering the complete search and analytics lifecycle with SELinux enforcing.

AWS Network & Kernel Tuning:

1. Network Stack: TCP BBR congestion control with fair queueing, increased connection backlogs, buffer adjustments, and MTU probing enabled.

2. System Tuning: Red Hat tuned daemon active with a custom cloud profile, transparent hugepages set to madvise, and modified memory/EBS writeback parameters.

3. EC2 Integration: NVMe I/O timeouts, Amazon Time Sync (chrony), IRQ balance daemon, and size-capped persistent journald logging.

Operational Tools:

1. Preinstalled Tools: AWS SSM Session Manager enabled, CloudWatch Agent installed (disabled by default).

Maintenance:

1. Maintenance Specifications: Rebuilt and updated bi-weekly to monthly incorporating upstream OpenSearch and Rocky Linux 9.8 security updates, with artifact documentation refreshed per release.

About OpenSearch

An open-source, distributed search and analytics engine forked from Elasticsearch, built for full-text search, log analytics, and application monitoring at scale. It integrates with observability and dashboarding tools such as Grafana, Kibana, Logstash, Prometheus, and Graylog, pairs naturally with data pipelines built on Apache Kafka and RabbitMQ, and runs comfortably alongside adjacent engines including Apache Solr, Typesense, and Meilisearch.

About Rocky Linux 9

Built directly from RHEL 9 source code for binary compatibility with the Red Hat 9 ecosystem, with predictable update cadences and a maintenance lifecycle through 2032. Any application compiled, certified, or documented for RHEL 9 runs without modification, and the platform is structurally aligned with AlmaLinux, CentOS Stream, and legacy CentOS deployments.