The CIS Benchmarks are secure configuration guides published by the Center for Internet Security, drawn up by expert consensus. They cover operating systems —Amazon Linux, Ubuntu, RHEL, Windows— with hundreds of concrete recommendations: file permissions, kernel parameters, password policies, services that should be disabled or audit configuration.
Applying hardening to the AMI —rather than to every already-deployed server— is the most efficient route: you harden once and every instance is born secure. It is the “secure by default” approach demanded by frameworks such as ISO 27001, SOC 2, PCI DSS or national security schemes.
L1 and L2 levels: how far to tighten
CIS defines profiles by level. Choosing well avoids breaking applications through excess of zeal.
| Profile | Goal | When to use it |
|---|---|---|
| Level 1 (L1) | Essential security with no relevant functional impact | Starting point for most workloads |
| Level 2 (L2) | Defence in depth for sensitive environments | Regulated data, high risk; may need tuning |
| STIG | US Department of Defense requirements | Government or defence contracts |
CIS hardening profiles and their scope of application.
How to automate hardening in the image
Manual hardening neither scales nor is auditable. These are the three most common ways to bring it into the build pipeline:
- EC2 Image Builder with CIS components: AWS offers integration with managed CIS levels that apply and validate the benchmark during the build, with the option of CIS Hardened images in the Marketplace.
- Ansible with a hardening role: reuse CIS-based roles for Linux inside a Packer provisioner; it is portable across clouds.
- Your own idempotent scripts: for specific cases, with the advantage of full control and the disadvantage of maintenance.
High-impact controls that must not be missing
If you had to prioritise, these CIS controls deliver the greatest risk reduction at the lowest cost:
- Disable direct root access over SSH and force key-based access, never passwords.
- Remove unnecessary packages and services to reduce the attack surface.
- Configure the host firewall (firewalld or nftables) with default deny.
- Enable auditing (
auditd) and centralised event logging. - Apply secure kernel parameters (
sysctl) against spoofing and network attacks. - Strict password policies and account lockout.
- Correct permissions on critical files:
/etc/passwd,/etc/shadowand the boot directories.
Validate that hardening really was applied
Hardening without verifying is an act of faith. Add an automated validation stage that scores the image against the benchmark and fails the build if it misses the threshold.
- CIS-CAT, InSpec or OpenSCAP scan the freshly baked instance and generate a compliance report.
- Pass threshold: define, for instance, “≥ 95 % of L1 controls passed” as a quality gate.
- Audit evidence: keep the report as a build artefact; it will be pure gold at your next SOC 2 or ISO audit.
The balance: security without breaking the application
The classic mistake is applying L2 blindly and discovering the application no longer starts. The sensible strategy: start from L1, measure and raise L2 controls selectively, testing in a staging environment. Document every justified exception; a control disabled with a recorded reason is acceptable in an audit, one disabled silently is not.
Frequently asked questions
Does CIS hardening slow my instances down?
The performance impact of the L1 profile is practically nil. Some intensive L2 auditing controls can add overhead, which is why they are applied selectively and measured.
Do I need to buy CIS Hardened images or can I do it myself?
You can harden yourself with Ansible, OpenSCAP or EC2 Image Builder components. The CIS Hardened images in the Marketplace save work and include validation, but they are not indispensable.
Does hardening alone make me ISO 27001 or PCI DSS compliant?
Hardening is an important technical control, but compliance also covers processes, policies and evidence. Hardening your AMIs gets you a long way, but it does not replace the rest of the compliance framework.
At imaxe.cloud we start from images hardened according to industry good practice so you deploy on a secure foundation.
