Deployment guide

AlmaLinux

Overview

AlmaLinux is a community-owned, open-source enterprise Linux distribution. The SecureAnyCloud Hardened AlmaLinux 8, 9 & 10 AMIs let you deploy hardened AlmaLinux instances on EC2 without building your own hardening pipeline. Every AMI in this listing boots with key-only SSH, no default passwords, unique SSH host keys generated on first boot, and compliance evidence included on the instance.

This page is the entry point for the Hardened AlmaLinux 8, 9 & 10 AMIs: Minimal, LVM, STIG, Essential Eight AWS Marketplace listing. The listing is a single product that offers several products and releases as separate software versions. Subscribe once, then choose the version you want from the Software version list at launch, and open its guide below for the full setup and connection walk-through.

What you get with every version:

Built from the official AlmaLinux image, fully patched at build time and remediated with the OpenSCAP CIS Level 1 Server profile (SCAP Security Guide). STIG and Essential Eight variants apply the OpenSCAP DISA STIG or ACSC Essential Eight profile instead.
A pass rate measured on each image as built and published in every version's release notes (98% or more of scored rules on the CIS images). The full HTML report and the reason for each waived rule ship on the instance under /usr/share/doc/sac/.
Unique SSH host keys and machine ID generated on every instance's first boot. Root is locked, there are no default passwords, and there is no build residue or shared keys.
Hardening for EC2: IMDSv2 required, SELinux enforcing, chrony on Amazon Time Sync, automatic security updates with dnf-automatic, an AIDE file-integrity database on the CIS and STIG images, cloud-init and current kernels.

Pricing is metered hourly per EC2 instance type and is the same for every version in this listing. The recommended instance type is m5.large.

Videos

These short narrated videos cover what this listing offers, how to launch it on AWS, and a deep dive recorded on the images themselves. Each video has English captions.

Hardened AlmaLinux 8, 9 & 10 AMIs: overview

A tour of the AWS Marketplace listing, covering eleven AlmaLinux versions, pricing, usage and support.

AlmaLinux 8, 9 & 10 AMIs: launch and log in

How to subscribe, launch from the console or the AWS CLI, connect over SSH, and check the instance.

Hardened AlmaLinux 8, 9 & 10 AMIs: deep dive

The compliance evidence, the LVM layout and how to grow a volume, and the Essential Eight and STIG profiles, shown on real instances.

How to pick a version

Open the listing on AWS Marketplace, choose View purchase options, then choose Subscribe. One subscription covers every product and release in the listing, and the free trial starts with it.

When the subscription is active, choose Launch your software.

Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for full control). In Version, choose the product and release you want. Each version is a separate software version, named <distribution> <release>[ <variant>] - <date>, for example AlmaLinux 10 LVM - YYYY-MM-DD. The date is when that version was added to the listing.

Choose your Region and an instance type (m5.large is recommended), your EC2 key pair and a security group that opens port 22 from your own network only. Then choose Launch.

After launch, open the product's guide below for the first login.

You can run several products from the same subscription. Launch one instance per product, each from its own software version.

Releases and variants in this listing, newest release first:

AlmaLinux: 10.2 (standard); 10 (LVM, Minimal); 9.8 (standard); 9 (Essential Eight, LVM, Minimal, STIG); 8.10 (standard); 8 (LVM, Minimal)

Security model

Every version in this listing follows the same model:

Fully patched. Every package is updated when the image is built, superseded kernels are removed, and automatic security updates stay switched on.

Key-only SSH. You sign in with your EC2 key pair as the distribution's default user. Password login is disabled, the root account is locked, and no account has a password.

Nothing shared between instances. No SSH keys, host keys, machine ID or credentials are baked into the image. Each instance generates its own on first boot.

IMDSv2. Launch with instance metadata version 2 (token required).

Only port 22. Open SSH in your security group to your own network only.

Benchmark hardening for AlmaLinux 9 Essential Eight and AlmaLinux 9 STIG. These versions are remediated against the named OpenSCAP profile, and their guide shows the report.

Choose your product

Distribution Software version Guide

AlmaLinux AlmaLinux 10 LVM Open guide →

AlmaLinux AlmaLinux 10 Minimal Open guide →

AlmaLinux AlmaLinux 10.2 Open guide →

AlmaLinux AlmaLinux 8 LVM Open guide →

AlmaLinux AlmaLinux 8 Minimal Open guide →

AlmaLinux AlmaLinux 8.10 Open guide →

AlmaLinux AlmaLinux 9 Essential Eight Open guide →

AlmaLinux AlmaLinux 9 LVM Open guide →

AlmaLinux AlmaLinux 9 Minimal Open guide →

AlmaLinux AlmaLinux 9 STIG Open guide →

AlmaLinux AlmaLinux 9.8 Open guide →

How to tell which version you launched

The EC2 console shows the version you chose on the instance's launch record (AMI name and description), and your AWS Marketplace subscription shows it too. On the instance itself, cat /etc/os-release shows the distribution and release. Open the matching guide above for the rest of the walk-through.

Support

SecureAnyCloud provides 24/7 support for every version in this listing through the AWS Marketplace support channel. Raise a ticket through the Marketplace console or email sales@secureanycloud.com.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Hardened AlmaLinux 8, 9 & 10 AMIs: Minimal, LVM, STIG, Essential Eight with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS