AlmaLinux 8.10

Option A: Azure Portal

• Open the Azure Marketplace and search for "AlmaLinux 8.10 SecureAnyCloud".
• Select the image and choose Create.
• On the Basics tab, set Subscription to your Azure subscription, Resource Group to a new or existing group, Virtual Machine Name to a name for your VM, Region to your preferred Azure region, and Size to Standard_B2s (recommended).
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Select Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:almalinux-8-10:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-almalinux-8-10-vm \
  --image sac1647283583153:almalinux-8-10:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-almalinux-8-10-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

Check that the machine is the AlmaLinux 8.10 release you expect:

cat /etc/almalinux-release grep -E '^(NAME|VERSION|ID|PLATFORM_ID)=' /etc/os-release uname -rm

Expected output:

AlmaLinux release 8.10 (Cerulean Leopard) NAME="AlmaLinux" VERSION="8.10 (Cerulean Leopard)" ID="almalinux" PLATFORM_ID="platform:el8" 4.18.0-553.153.1.el8_10.x86_64 x86_64

The kernel version carries an el8_10 tag. This tag shows that the machine tracks the 8.10 maintenance stream rather than an older 8 series minor release.

The image is fully updated at build time. dnf check-update returns exit code 100 when updates are pending and 0 when none are. Check now:

sudo dnf check-update echo "exit code: $?"

List the enabled repositories to confirm your update path is intact:

dnf repolist --enabled

Expected output:

repo id repo name appstream AlmaLinux 8 - AppStream baseos AlmaLinux 8 - BaseOS extras AlmaLinux 8 - Extras

Because 8.10 is the last minor release in the RHEL 8 family, applying updates keeps you on 8.10 rather than moving you to a new point release.

This image also arms dnf-automatic, so security updates are downloaded and applied on a timer without any action from you. You can still run updates on your own schedule:

sudo dnf upgrade -y

Reboot if a new kernel was installed:

sudo systemctl reboot

Confirm that SELinux is enforcing, root is locked and SSH is key-only:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication)'

Expected output:

Enforcing root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.) permitrootlogin without-password pubkeyauthentication yes passwordauthentication no

without-password is how OpenSSH reports the prohibit-password setting. Both names mean the same thing: root may not authenticate with a password.

Confirm that the Azure Linux Agent, cloud-init and time synchronization are healthy and that unattended security updates are armed. The last two commands show your disk and memory resources:

systemctl is-active waagent
systemctl is-enabled waagent cloud-init --version
systemctl is-enabled dnf-automatic.timer
systemctl is-active chronyd df -h / free -h

waagent lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled. An enabled dnf-automatic.timer keeps the machine applying security updates on its own after launch.

The Azure Network Security Group (NSG) controls inbound and outbound traffic. It is the first, and usually the only, place you need to open a port. The image advertises a single inbound port, SSH on 22.

firewalld is installed on this image but left inactive and disabled. It does not filter traffic by default, so your NSG rules take effect exactly as written, with no second layer to keep in sync.

Confirm what is listening before you open anything:

ss -tlnp

On a fresh machine, the listeners are sshd on port 22 and rpcbind on port 111, a local RPC helper. Only port 22 is advertised for inbound access, and the Azure NSG governs what is reachable from outside.

If your policy also requires a host firewall, enable the one that is already installed:

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Once firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service. Add the SSH service first, as shown above, so that enabling the firewall does not lock you out.

AppStream carries the application packages. Search it, then install what you need:

dnf search nginx

AlmaLinux 8 uses modules. AppStream ships several versions of the same language or database as separate streams, so you can pick a version rather than take the default:

dnf module list nginx

Install a package and enable it in the usual way, for example sudo dnf install -y nginx followed by sudo systemctl enable --now nginx.

To add another administrator, create the account with sudo adduser <name> and add it to the wheel group with sudo usermod -aG wheel <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600, and set the .ssh directory to mode 700, owned by that user.

The image ships with no human accounts at all, so azureuser is the only login until you add one. Check the wheel group:

getent group wheel

Option A: AWS Marketplace console

• Open the SecureAnyCloud AlmaLinux listing on AWS Marketplace, choose View purchase options, then choose Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for full control. In Version, choose AlmaLinux 8.10 - YYYY-MM-DD (the date is when the version was added), and select your Region.
• Instance type: choose m5.large (recommended). Any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
• Key pair: choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.
• Security group: allow inbound TCP 22 from your own IP address or network only.
• Storage: the root volume is 10 GiB gp3 by default. Choose a larger size if you need one. cloud-init grows the root partition and filesystem to fill it on first boot.
• Metadata: leave the defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this command on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and replace the key pair, security group and subnet with your own. The root device of this AMI is /dev/sda1:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=almalinux-8-10}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

From your workstation, connect as ec2-user with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>

There is no password to enter. If SSH asks for one, or says Too many authentication failures, see Troubleshooting below.

You can also connect without opening port 22 at all, through AWS Systems Manager Session Manager, if the instance has an instance profile that allows Systems Manager. The agent is installed and running on this image.

First boot: apply the security updates released since the image was built, then reboot. dnf-automatic installs security updates once a day, kernels included, but a new kernel runs only after a reboot. Do this once before you put the instance into service:

sudo dnf -y upgrade --security sudo systemctl reboot

Reconnect after about a minute. uname -r then shows the new kernel if one was installed. Step 10 covers the patch level in detail.

Check that the instance is the AlmaLinux 8.10 release you expect:

cat /etc/almalinux-release grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release uname -srm

Expected output:

AlmaLinux release 8.10 (Cerulean Leopard) NAME="AlmaLinux" VERSION="8.10 (Cerulean Leopard)" ID="almalinux" VERSION_ID="8.10" PLATFORM_ID="platform:el8" PRETTY_NAME="AlmaLinux 8.10 (Cerulean Leopard)" Linux 4.18.0-553.176.1.el8_10.x86_64 x86_64

This version stays on 8.10. 8.10 is the final minor release of AlmaLinux 8, so there will be no 8.11. The repositories use the AlmaLinux 8 release stream ($releasever is 8), and the AlmaLinux mirror list serves that stream from the 8.10 tree. Updates keep arriving as ordinary 8.10 packages through dnf until AlmaLinux 8 reaches its end of life in 2029.

Your kernel version may be newer if updates have installed since this image was built.

This version keeps the AlmaLinux 8.10 EC2 package set whole. The packages that the Minimal version removes are installed here, and tuned is running. Verify:

rpm -qa | wc -l rpm -q tuned linux-firmware geolite2-city geolite2-country systemctl is-active tuned tuned-adm active

Expected output (the package versions change over time):

409 tuned-2.22.1-7.el8_10.noarch linux-firmware-20260908-145.gite981caea.el8_10.noarch geolite2-city-20180605-1.el8.noarch geolite2-country-20180605-1.el8.noarch active Current active profile: virtual-guest

• tuned is the system tuning daemon. Its virtual-guest profile, the one tuned-adm recommend picks on EC2, sets memory writeback and swappiness, disk readahead and CPU performance settings for a guest on a hypervisor. To use another profile, list the profiles with tuned-adm list and switch with, for example, sudo tuned-adm profile throughput-performance.
• linux-firmware holds firmware for physical network, storage and graphics hardware. EC2 instances do not load it, but it is part of the AlmaLinux package set and takes about 1.6 GB of the root volume.
• geolite2-city and geolite2-country are IP geolocation databases that some tools can use.
• The sos support-report collector is not part of the AlmaLinux 8 EC2 base image. If a support engineer asks for a report, install it with sudo dnf -y install sos and run sudo sos report.

What the Minimal version drops. AlmaLinux 8 Minimal removes linux-firmware, geolite2-city, geolite2-country and tuned, and lists the removals in /usr/share/doc/sac/minimal-manifest.txt on its own image. A new Minimal instance built the same day has 405 packages against 409 here.

Everything else is the same in both versions. The AlmaLinux 8.10 EC2 base image is already small, so neither version has wireless or sound firmware, Cockpit or Plymouth installed. Both carry the same hardening, compliance tooling and AWS agents. The package count on your instance moves by a few as kernels and updates install.

The evaluation that the build ran after its reboot ships on the image. List the files and print the summary:

ls -lh /usr/share/doc/sac/ python3 -c "import json; s=json.load(open('/usr/share/doc/sac/cis-l1-summary.json')); print('profile: ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived: ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 38M -rw-r--r--. 1 root root 36M Oct 19 23:36 cis-l1-arf.xml -rw-r--r--. 1 root root 2.4M Oct 19 23:36 cis-l1-report.html -rw-r--r--. 1 root root 1.2K Oct 19 23:36 cis-l1-summary.json -rw-r--r--. 1 root root 2.0K Oct 19 23:36 cis-l1-tailoring.xml -rw-r--r--. 1 root root 3.2K Oct 19 23:36 cis-l1-waivers.txt -rw-r--r--. 1 root root 1.6K Oct 19 23:29 scap-security-guide-LICENSE.txt profile: CIS Level 1 Server (SCAP Security Guide 0.1.82) scored rules: 294 pass: 294 fail: 0 rate: 100.0% waived: 8 not applicable: 38 evaluated at: 2026-10-19T23:36:36Z

• cis-l1-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• cis-l1-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• cis-l1-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not selected or waived are not counted.

To copy the report to your workstation, run this command on the workstation:

scp -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>:/usr/share/doc/sac/cis-l1-report.html .

The eight waived rules

List the waived rules:

grep -v '^#' /usr/share/doc/sac/cis-l1-waivers.txt | cut -f1,2

Expected output:

partition_for_tmp [single-volume-partitions] grub2_password [serial-console-and-boot] grub2_uefi_password [serial-console-and-boot] ensure_root_password_configured [serial-console-and-boot] accounts_maximum_age_login_defs [key-only-account-aging] account_disable_post_pw_expiration [key-only-account-aging] sshd_limit_user_access [ssh-access-list] service_systemd-journal-upload_enabled [log-remote-destination]

The full reason for each is the third column of the same file. In short:

• Separate /tmp partition. This version boots from one EBS root volume. The LVM versions of this listing provide separate volumes for /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home.
• Boot loader and root passwords. A GRUB or root password would have to be baked into the image, giving every instance the same secret. Root stays locked with no password. Set your own if you need serial console access (see Step 11).
• Password ageing defaults. The accounts cloud-init creates are key-only. An ageing limit would expire them and lock the SSH key out. Accounts that do have a password are still aged.
• SSH AllowUsers/AllowGroups. A list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.
• Remote journal upload. The benchmark switches on systemd-journal-upload, which sends the system journal to a remote log server, but the image cannot know your log server. Switched on with no destination, the service fails at every boot. systemd-journal-remote is installed and the upload service is left off. To use it, see "Send the journal to your own log server" below.

Every scored rule passes

Print the list of failing rules:

python3 -c "import json; print(json.load(open('/usr/share/doc/sac/cis-l1-summary.json'))['failingRules'])"

Expected output:

[]

The list of failing rules is empty, so every rule the profile scores on this image passes. Rules that do not apply to an EC2 instance, for example wireless interfaces, are reported as not applicable and are not counted.

Send the journal to your own log server

If you run a systemd-journal-remote collector, point the image at it and switch the upload service on. Replace the address with your collector's:

echo 'URL=https://logs.example.internal:19532' | sudo tee -a /etc/systemd/journal-upload.conf
sudo systemctl enable --now systemd-journal-upload

You can repeat the evaluation at any time with the same content and tailoring. It takes about a minute. Run it:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/sac/cis-l1-tailoring.xml \
  --profile xccdf_co.sac_profile_cis-l1_ec2_single \
  --results /tmp/cis-check-results.xml --report /tmp/cis-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-almalinux8-ds.xml > /tmp/cis-check.log 2>&1 echo "oscap exit code: $? (0 = every rule passed, 2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/cis-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 0 (0 = every rule passed, 2 = at least one rule did not pass) {'notapplicable': 38, 'notselected': 1369, 'pass': 294} pass rate: 100.0%

Your own report is at /tmp/cis-check-report.html. As you install software and change settings, re-run the evaluation to see how your changes affect the result.

Send a metadata request without a token, then repeat it with a session token:

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401 us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2. Every current AWS SDK and the AWS CLI do this automatically.

Check the firewall state, the active rules and the listening ports:

sudo firewall-cmd --state sudo firewall-cmd --list-all sudo ss -tlnp

Expected output:

running public (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: dhcpv6-client ssh ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=849,fd=3)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=849,fd=4))

• Only sshd listens, on port 22. Nothing else on the image opens a TCP port.
• The public zone allows ssh and dhcpv6-client. The DHCPv6 client receives replies from the IPv6 DHCP server, which is how an instance in an IPv6-enabled subnet gets its address. The AlmaLinux default cockpit service is removed from the zone, and Cockpit is not installed.
• The loopback interface sits in firewalld's trusted zone, with rules that drop traffic claiming a loopback source from anywhere else (a CIS requirement).

To open a port for your own service, take two steps. Allow the port in the instance's security group, and allow it in firewalld. For example, for a web server on 443, run this on the instance:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld, or the other way round, the traffic does not arrive.

Check the time and Systems Manager services, then list the time sources:

systemctl is-active chronyd amazon-ssm-agent chronyc -n sources

Expected output (the pool servers and timings vary):

active active MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^- 23.172.120.58 2 6 17 43 +443us[ +488us] +/- 56ms ^- 97.107.136.23 2 6 17 44 +123us[ +168us] +/- 7586us ^- 139.177.202.26 2 6 17 43 -4318us[-4273us] +/- 75ms ^- 23.157.100.123 2 6 17 43 -572us[ -527us] +/- 34ms ^* 169.254.169.123 3 4 77 11 +1945ns[ +123us] +/- 522us

The ^* marks the source that chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public AlmaLinux pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's own package at its current release (3.3.5390.0 on this build). It is not in the AlmaLinux repositories, so dnf does not update it. Systems Manager can keep it current for you, through the AWS-UpdateSSMAgent document or the Auto update SSM Agent setting in Fleet Manager.

The image is fully patched at build time. Check what is pending now:

sudo dnf -q check-update --refresh echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)" grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer uname -r

Expected output on an instance launched soon after the image was built (later launches list the updates released since, with exit code 100):

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available) upgrade_type = security apply_updates = yes enabled 4.18.0-553.176.1.el8_10.x86_64

dnf-automatic runs daily (06:00, with a random delay of up to an hour) and installs security updates automatically. To update everything now, run:

sudo dnf -y upgrade

dnf-automatic installs a new kernel but does not reboot, so the running kernel stays the old one until you reboot. Reboot if a new kernel was installed:

sudo systemctl reboot

Check SELinux, the root account, the SSH settings, the login banner, EC2 Instance Connect and the host key permissions:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval|banner|authorizedkeyscommand) ' cat /etc/issue.net rpm -q --quiet ec2-instance-connect && echo "EC2 Instance Connect: installed" || echo "EC2 Instance Connect: not installed"
sudo ls -l /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_rsa_key

Expected output:

Enforcing root LK 2026-09-28 0 99999 7 -1 (Password locked.) maxauthtries 4 clientaliveinterval 300 permitrootlogin no pubkeyauthentication yes passwordauthentication no banner /etc/issue.net authorizedkeyscommand none Authorized users only. All activity may be monitored and reported. EC2 Instance Connect: not installed -rw-------. 1 root ssh_keys 537 Oct 19 23:53 /etc/ssh/ssh_host_ecdsa_key -rw-------. 1 root ssh_keys 432 Oct 19 23:53 /etc/ssh/ssh_host_ed25519_key -rw-------. 1 root ssh_keys 2622 Oct 19 23:53 /etc/ssh/ssh_host_rsa_key

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on. If your own software is denied, check sudo ausearch -m avc -ts recent rather than disabling SELinux.
• LK means the root account is locked.
• maxauthtries 4 and clientaliveinterval 300 come from the CIS profile. SSH allows four authentication attempts per connection and checks idle sessions every five minutes.
• authorizedkeyscommand none means SSH reads keys only from each user's authorized_keys file.
• The banner text is shown before login.
• The SSH host keys are created on your instance's first boot and are readable by root only (-rw-------). AlmaLinux creates them group-readable by ssh_keys. A small boot service, sac-sshd-hostkey-perms.service, tightens them to 0600 before the SSH server starts, which is what the CIS rule for host key permissions checks.

EC2 Instance Connect is not installed. The AlmaLinux 8 base image carried it as an unsigned package from outside the AlmaLinux repositories, so dnf could never update it. It also added a second way to authorize SSH keys, through the EC2 Instance Connect API. It is removed so that your key pair is the only SSH credential. Use Session Manager (Step 2) for browser-based access.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. If you want serial console access, set a password for your own user on your running instance. The password is yours and is not on the image:

sudo passwd ec2-user

Check the root filesystem, the cloud-init disk growth, swap and the AIDE schedule:

df -hT /
sudo grep -E 'cc_growpart.*(resized|NOCHANGE)' /var/log/cloud-init.log | tail -1 swapon --noheadings --show | wc -l sudo grep -h aide /etc/crontab

Expected output with the default 10 GiB root volume (on a larger volume, Size is larger and the cloud-init line says resized):

Filesystem Type Size Used Avail Use% Mounted on /dev/nvme0n1p4 xfs 8.8G 3.3G 5.6G 37% / 2026-10-19 23:53:55,341 - cc_growpart.py[DEBUG]: '/' NOCHANGE: no change necessary (/dev/nvme0n1, 4) 0 05 4 * * * root /usr/sbin/aide --check

• Disk layout. The instance boots with UEFI. The root filesystem is XFS on partition 4 of the root volume. /boot (XFS) and /boot/efi are separate small partitions.
• Disk use. About 1.6 GB of the used space is the linux-firmware bundle (Step 4). The dnf metadata cache that the refresh in Step 10 downloads adds a little over 200 MB, and sudo dnf clean all removes it. Choose a larger root volume at launch if you need room for your own software and data.
• Disk growth. cloud-init grows the root partition and filesystem to the volume size on first boot. To grow later, increase the EBS volume size in the console or with aws ec2 modify-volume, then run sudo growpart /dev/nvme0n1 4 && sudo xfs_growfs / (or reboot).
• Swap. The image has no swap. Add a swap file yourself if your workload needs one.
• AIDE. The file integrity database is built from the image's own files, and the CIS profile schedules aide --check daily at 04:05 from /etc/crontab.

The instance uses the standard AlmaLinux 8 repositories (BaseOS, AppStream and Extras):

sudo dnf -q list --available nginx

Expected output (the version changes over time):

Available Packages nginx.x86_64 1:1.14.1-9.module_el8.10.0+4171+d7eec01b.alma.1 appstream

AlmaLinux 8 ships several versions of some software as module streams. The default nginx stream is 1.14. sudo dnf module list nginx lists the newer streams (up to 1.24), and sudo dnf -y module enable nginx:1.24 selects one before you install.

Install and start software in the usual way, for example sudo dnf -y install nginx then sudo systemctl enable --now nginx. Then open its port in the security group and firewalld (Step 8). The AWS CLI is not on the image. Install the current version from AWS (the AWS CLI install guide) if you need it.

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys. restorecon gives the file the SELinux label that sshd expects.

The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice. SSH stays key-only, and sudo uses the password. Only ec2-user, created by cloud-init, has password-free sudo.