secure but unpractical and unsupported
The pre-hardened image by CIS helps solving the Inspector vulnerabilities, however there is no effective support - you can only raise a generic question not linked to your AWS account, you'll get a generic answer.
The CIS team doesn't feel committed to this product.
Also, they do not provide any guidance on upgrading to newer versions - having asked them via support request, the answer was simply "it's up to you".
I am unsatisfied but I have no other options - hardening a Windows system takes too much time which the my project plan can't afford.