Oracle Linux 9 LVM

Option A: AWS Marketplace console

• Open the SecureAnyCloud Oracle Linux listing on AWS Marketplace, choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for full control. In Version, select Oracle Linux 9 LVM - YYYY-MM-DD (the date is when the version was added), then select your Region.
• Instance type: m5.large is recommended, and any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
• Key pair: choose your EC2 key pair. It is the only way in, and RSA and ED25519 keys both work.
• Security group: allow inbound TCP 22 from your own IP address or network only.
• Storage: the root volume is 12 GiB gp3 by default. You can choose a larger size, but the extra space stays unused until you assign it to the logical volumes you choose (Step 12).
• Metadata: leave the defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this command on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the key pair, security group and subnet with your own. The root device of this AMI is /dev/xvda:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/xvda,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=oracle-linux-9-lvm}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

From your workstation, connect as ec2-user with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>

There is no password to enter. If SSH asks for one, or reports Too many authentication failures, see Troubleshooting below.

You can also connect through AWS Systems Manager Session Manager without opening port 22. This requires an instance profile that allows Systems Manager. The agent is installed and running on this image.

cat /etc/oracle-release grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release uname -srm rpm -q kernel-uek rpm -qa | wc -l

Expected output:

Oracle Linux Server release 9.8 NAME="Oracle Linux Server" VERSION="9.8" ID="ol" VERSION_ID="9.8" PLATFORM_ID="platform:el9" PRETTY_NAME="Oracle Linux Server 9.8" Linux 6.12.0-207.111.5.5.el9uek.x86_64 x86_64 kernel-uek-6.12.0-207.111.5.5.el9uek.x86_64 419

The image boots the Unbreakable Enterprise Kernel (UEK Release 8, kernel 6.12), the kernel Oracle uses in its own cloud images. The Red Hat Compatible Kernel is not installed.

A new instance has 419 packages. They are Oracle's cloud image, LVM2 and the BIOS and UEFI boot loader packages the LVM disk needs, and the OpenSCAP, AIDE, audit and Postfix packages that the PCI-DSS remediation adds. The count moves by a few as kernels and updates install.

This version follows Oracle Linux 9. It receives every Oracle Linux 9 minor release (9.8 at build time) and new UEK builds through normal dnf updates, so your kernel version may be newer than the one shown.

The disk and its volumes:

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS /dev/nvme0n1

Expected output with the default 12 GiB root volume:

NAME SIZE TYPE FSTYPE MOUNTPOINTS nvme0n1 12G disk ├─nvme0n1p1 1M part ├─nvme0n1p2 200M part vfat /boot/efi ├─nvme0n1p3 1G part xfs /boot └─nvme0n1p4 10.8G part LVM2_member ├─ol-root 4G lvm xfs / ├─ol-home 1G lvm xfs /home ├─ol-tmp 1G lvm xfs /tmp ├─ol-var 1.5G lvm xfs /var ├─ol-var_tmp 512M lvm xfs /var/tmp ├─ol-var_log 1G lvm xfs /var/log └─ol-var_log_audit 1G lvm xfs /var/log/audit

The volume group, its logical volumes and the mount options each volume carries:

sudo vgs
sudo lvs -o lv_name,lv_size,lv_path ol for m in / /home /tmp /var /var/tmp /var/log /var/log/audit /boot /dev/shm; do printf '%-15s %-29s %s\n' "$m" "$(findmnt -no SOURCE "$m")" "$(findmnt -no OPTIONS "$m" | tr , '\n' | grep -xE 'rw|ro|nodev|nosuid|noexec' | paste -sd, -)"; done

Expected output:

VG #PV #LV #SN Attr VSize VFree ol 1 7 0 wz--n- 10.80g 820.00m LV LSize Path home 1.00g /dev/ol/home root 4.00g /dev/ol/root tmp 1.00g /dev/ol/tmp var 1.50g /dev/ol/var var_log 1.00g /dev/ol/var_log var_log_audit 1.00g /dev/ol/var_log_audit var_tmp 512.00m /dev/ol/var_tmp / /dev/mapper/ol-root rw /home /dev/mapper/ol-home rw,nosuid,nodev /tmp /dev/mapper/ol-tmp rw,nosuid,nodev,noexec /var /dev/mapper/ol-var rw,nosuid,nodev /var/tmp /dev/mapper/ol-var_tmp rw,nosuid,nodev,noexec /var/log /dev/mapper/ol-var_log rw,nosuid,nodev,noexec /var/log/audit /dev/mapper/ol-var_log_audit rw,nosuid,nodev,noexec /boot /dev/nvme0n1p3 rw,nosuid,nodev /dev/shm tmpfs rw,nosuid,nodev,noexec

• The disk has a 1 MiB BIOS boot partition, a 200 MiB EFI system partition, a 1 GiB /boot (XFS) and one LVM physical volume. The AMI boots in legacy BIOS mode.
• The mount options are set in /etc/fstab by filesystem UUID, so they survive reboots and apply on every instance launched from the image. The last column shows the options that matter for hardening, and findmnt lists the rest.
• The PCI-DSS v4.0 Control Baseline profile has no rules about the disk layout, so the separate volumes and their mount options are not part of the score in Step 5. The commands above are the check.
• The volume group keeps 820 MiB free at the default size, so you can grow the volume that fills first without touching EBS (Step 12).

The kernel finds its root filesystem on the logical volume. On Oracle Linux 9 the boot arguments live in two files, and both name the logical volume. One is /etc/kernel/cmdline, from which every kernel that a future update installs gets its boot entry. The other is the boot entry of the installed kernel. The first line pair below is the running kernel's own command line:

grep -o 'root=[^ ]*\|rd.lvm[^ ]*' /proc/cmdline
grep -o 'root=[^ ]*\|rd.lvm[^ ]*' /etc/kernel/cmdline
sudo sh -c 'grep -h "^options" /boot/loader/entries/*.conf' | grep -o 'root=[^ ]*\|rd.lvm[^ ]*' rpm -q lvm2 cloud-utils-growpart xfsprogs

Expected output:

root=/dev/mapper/ol-root rd.lvm.lv=ol/root root=/dev/mapper/ol-root rd.lvm.lv=ol/root root=/dev/mapper/ol-root rd.lvm.lv=ol/root lvm2-2.03.33-4.el9_8.1.x86_64 cloud-utils-growpart-0.33-1.el9.x86_64 xfsprogs-6.18.0-1.0.4.el9.x86_64

The evaluation the build ran after its reboot ships on the image:

ls -lh /usr/share/doc/sac/ python3 -c "import json; s=json.load(open('/usr/share/doc/sac/pci-dss-summary.json')); print('profile: ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived: ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 28M -rw-r--r--. 1 root root 25M Oct 21 20:10 pci-dss-arf.xml -rw-r--r--. 1 root root 2.6M Oct 21 20:10 pci-dss-report.html -rw-r--r--. 1 root root 1.3K Oct 21 20:10 pci-dss-summary.json -rw-r--r--. 1 root root 1.6K Oct 21 20:10 pci-dss-tailoring.xml -rw-r--r--. 1 root root 2.0K Oct 21 20:10 pci-dss-waivers.txt -rw-r--r--. 1 root root 1.6K Oct 21 20:02 scap-security-guide-LICENSE.txt profile: PCI-DSS v4.0 Control Baseline (SCAP Security Guide 0.1.82) scored rules: 228 pass: 223 fail: 5 rate: 97.8% waived: 5 not applicable: 13 evaluated at: 2026-10-21T20:10:35Z

• pci-dss-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• pci-dss-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• pci-dss-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not checked, not selected or waived are not counted.

To copy the report to your workstation, run this command on the workstation:

scp -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>:/usr/share/doc/sac/pci-dss-report.html .

The five waived rules

grep -v '^#' /usr/share/doc/sac/pci-dss-waivers.txt | cut -f1,2

Expected output:

sudo_require_authentication [default-user-sudo] ensure_root_password_configured [serial-console-and-boot] accounts_maximum_age_login_defs [key-only-account-aging] account_disable_post_pw_expiration [key-only-account-aging] sshd_limit_user_access [ssh-access-list]

The full reason for each is the third column of the same file. In short:

• Password for sudo: ec2-user is key-only with no password, and cloud-init gives it password-free sudo. Requiring a password for sudo would leave the only administrator unable to use it.
• Root password: a root password would have to be baked into the image, giving every instance the same secret. Root stays locked with no password. Set your own password if you need serial console access (see Step 11).
• Password ageing defaults: the accounts cloud-init creates are key-only. An ageing limit would expire them and lock out the SSH key. Accounts that do have a password are still aged.
• SSH AllowUsers/AllowGroups: a list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.

The five rules that do not pass

python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/sac/pci-dss-summary.json'))['failingRules']]"

Expected output:

accounts_password_last_change_is_in_past aide_build_database ensure_pam_wheel_group_empty selinux_confinement_of_daemons set_firewalld_default_zone

• Last password change date. The locked root account carries no "last changed" date in /etc/shadow, and the rule requires a date in the past for every account. Root has no password either way.
• AIDE database. The image ships an AIDE database built from its own files as the last build step (/var/lib/aide/aide.db.gz) and runs aide --check daily. The rule's file check does not find a database at the path it expects. To rebuild the database for your own instance after you install software, run sudo aide --init and move /var/lib/aide/aide.db.new.gz to /var/lib/aide/aide.db.gz.
• The su group. The profile restricts su to members of a group named sugroup (pam_wheel.so group=sugroup in /etc/pam.d/su). That group does not exist, so nobody can use su. The rule also requires the group to exist and be empty. To clear the finding without changing who can use su, run sudo groupadd sugroup.
• Unconfined daemons. The AWS Systems Manager agent runs as the SELinux type unconfined_service_t, because Amazon's package ships no SELinux policy for it. Every other daemon is confined.
• Default firewalld zone. The benchmark requires DefaultZone=drop in /etc/firewalld/firewalld.conf. The image keeps public as the default zone, bound to eth0 and allowing only SSH and the DHCPv6 client inbound. Incoming traffic is filtered the same way, and new interfaces still get a working zone. For the stricter default, run sudo firewall-cmd --set-default-zone=drop and keep eth0 in public.

Repeat the evaluation at any time with the same content and tailoring. It takes about a minute:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/sac/pci-dss-tailoring.xml \
  --profile xccdf_co.sac_profile_pci-dss_ec2_lvm \
  --results /tmp/pci-check-results.xml --report /tmp/pci-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml > /tmp/pci-check.log 2>&1 echo "oscap exit code: $? (2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/pci-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 2 (2 = at least one rule did not pass) {'fail': 5, 'notapplicable': 13, 'notchecked': 2, 'notselected': 695, 'pass': 223} pass rate: 97.8%

Your own report is at /tmp/pci-check-report.html. The content file is ssg-ol9-ds.xml, the Oracle Linux 9 data stream; the RHEL 9 data stream that the same package carries reports every rule as not applicable on Oracle Linux. Re-run the evaluation after you install software or change settings to see how your changes affect the result.

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401 us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2. Every current AWS SDK and the AWS CLI do this automatically.

sudo firewall-cmd --state sudo firewall-cmd --list-all sudo firewall-cmd --get-active-zones sudo ss -tlnp

Expected output:

running public (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: public interfaces: eth0 trusted interfaces: lo State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1133,fd=7)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=1133,fd=8))

• Only sshd listens, on port 22. Nothing else on the image opens a TCP port, and Postfix is disabled.
• The public zone allows ssh and dhcpv6-client. The second service carries replies to the instance's IPv6 DHCP client, which is how an instance in an IPv6-enabled subnet gets its address. The default cockpit service is removed from the zone, and Cockpit is not installed.
• The loopback interface sits in the firewalld trusted zone.

To open a port for your own service, allow it in both the instance's security group and firewalld. For example, for a web server on port 443, run this on the instance:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld, or the other way round, the traffic does not arrive.

systemctl is-active chronyd amazon-ssm-agent chronyc -n sources rpm -q amazon-ssm-agent

Expected output (the pool servers and timings vary):

active active MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^- 144.202.62.209 3 6 377 7 -607us[ -614us] +/- 22ms ^- 23.143.196.202 2 6 377 4 +1755us[+1755us] +/- 34ms ^- 139.177.202.26 2 6 377 6 -2257us[-2265us] +/- 75ms ^- 159.203.82.102 4 6 377 7 +372us[ +364us] +/- 8732us ^* 169.254.169.123 3 4 377 6 -20us[ -28us] +/- 448us amazon-ssm-agent-3.3.5538.0-1.x86_64

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's own package (3.3.5538.0 on this build). It is not in the Oracle Linux repositories, so dnf does not update it. Systems Manager can keep it current for you through the AWS-UpdateSSMAgent document or the Auto update SSM Agent setting in Fleet Manager.

The image is fully patched at build time. Check which updates are pending now:

sudo dnf -q check-update --refresh echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)" grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer uname -r dnf repolist

Expected output on an instance launched soon after the image was built (later launches list the updates released since, with exit code 100):

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available) upgrade_type = security apply_updates = yes enabled 6.12.0-207.111.5.5.el9uek.x86_64 repo id repo name ol9_UEKR8 Oracle Linux 9 UEK Release 8 (x86_64) ol9_appstream Oracle Linux 9 Application Stream Packages (x86_64) ol9_baseos_latest Oracle Linux 9 BaseOS Latest (x86_64)

The instance uses Oracle's public yum server (yum.oracle.com) for BaseOS, AppStream and UEK Release 8. No subscription is needed. dnf-automatic runs daily and installs security updates automatically. To update everything now, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval) '

Expected output:

Enforcing root LK 1969-12-31 0 99999 7 -1 (Password locked.) maxauthtries 4 clientaliveinterval 900 permitrootlogin no pubkeyauthentication yes passwordauthentication no

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on. If your own software is denied, check sudo ausearch -m avc -ts recent instead of disabling SELinux.
• LK means the root account is locked. The 1969-12-31 date is how passwd shows an empty "last changed" field (see Step 5).
• maxauthtries 4 and clientaliveinterval 900 come from the PCI-DSS profile. SSH allows four authentication attempts per connection and checks idle sessions every 15 minutes.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. For serial console access, set a password for your own user on your running instance. The password is yours and is not on the image:

sudo passwd ec2-user

sudo vgs ol df -h / /var /var/log
sudo grep -E 'cc_growpart.py.*(SKIPPED|resized|NOCHANGE)' /var/log/cloud-init.log | tail -1 | cut -c1-150 swapon --noheadings --show | wc -l sudo grep -h aide /etc/crontab systemctl is-enabled postfix sac-postfix-tls

Expected output with the default 12 GiB root volume:

VG #PV #LV #SN Attr VSize VFree ol 1 7 0 wz--n- 10.80g 820.00m Filesystem Size Used Avail Use% Mounted on /dev/mapper/ol-root 4.0G 2.1G 1.9G 53% / /dev/mapper/ol-var 1.5G 730M 707M 51% /var /dev/mapper/ol-var_log 924M 41M 884M 5% /var/log 2026-10-21 20:36:50,571 - cc_growpart.py[DEBUG]: '/' SKIPPED: Resizing mapped device (/dev/mapper/ol-root) skipped as it is not encrypted. 0 05 4 * * * root /usr/sbin/aide --check disabled enabled

cloud-init does not grow LVM volumes. On a single-volume image, cloud-init grows the root filesystem to the volume size on first boot. On this image the root filesystem is a logical volume, so cloud-init skips it (the SKIPPED line above). This is deliberate: you decide which volume gets the space.

When you launch with a bigger root volume, or grow the EBS volume later with aws ec2 modify-volume, add the space in three steps on the instance:

• Grow partition 4 (the LVM physical volume) to the end of the disk, and tell LVM:

sudo growpart /dev/nvme0n1 4
sudo pvresize /dev/nvme0n1p4

• Give space to the volumes that need it. --resizefs grows the XFS filesystem in the same step, online and without a reboot:

sudo lvextend --resizefs -L +4G /dev/ol/root
sudo lvextend --resizefs -L +2G /dev/ol/var

• Check the result:

sudo vgs ol df -h / /var

Example output after growing a 12 GiB volume to 20 GiB and running the commands above (the filesystem geometry that xfs_growfs prints is shortened to ...):

CHANGED: partition=4 start=2510848 old: size=22654943 end=25165790 new: size=39432159 end=41943006 Physical volume "/dev/nvme0n1p4" changed 1 physical volume(s) resized or updated / 0 physical volume(s) not resized File system xfs found on ol/root mounted at /. Size of logical volume ol/root changed from 4.00 GiB (1024 extents) to 8.00 GiB (2048 extents). Extending file system xfs to 8.00 GiB (8589934592 bytes) on ol/root... xfs_growfs /dev/ol/root meta-data=/dev/mapper/ol-root isize=512 agcount=8, agsize=131072 blks ... data blocks changed from 1048576 to 2097152 xfs_growfs done Extended file system xfs on ol/root. Logical volume ol/root successfully resized. File system xfs found on ol/var mounted at /var. Size of logical volume ol/var changed from 1.50 GiB (384 extents) to 3.50 GiB (896 extents). Extending file system xfs to 3.50 GiB (3758096384 bytes) on ol/var... xfs_growfs /dev/ol/var meta-data=/dev/mapper/ol-var isize=512 agcount=8, agsize=49152 blks ... data blocks changed from 393216 to 917504 xfs_growfs done Extended file system xfs on ol/var. Logical volume ol/var successfully resized. VG #PV #LV #SN Attr VSize VFree ol 1 7 0 wz--n- 18.80g 2.80g Filesystem Size Used Avail Use% Mounted on /dev/mapper/ol-root 8.0G 2.1G 5.9G 27% / /dev/mapper/ol-var 3.5G 730M 2.7G 21% /var

To give a volume all the remaining free space instead, use -l +100%FREE, for example sudo lvextend --resizefs -l +100%FREE /dev/ol/var_log. Leaving some space unallocated is useful, because you can then grow whichever volume fills first without touching EBS. XFS volumes grow online but cannot shrink, so add space in steps.

• Adding a data volume. Attach a new EBS volume, then give it its own volume group (for example sudo pvcreate /dev/nvme1n1, sudo vgcreate datavg /dev/nvme1n1, sudo lvcreate -n data -l 100%FREE datavg, sudo mkfs.xfs /dev/datavg/data). Mount it from /etc/fstab by UUID with the nofail option, so the instance still boots if the volume is ever detached. Check the device name with lsblk first: on Nitro instances the second EBS volume is usually /dev/nvme1n1. The image ships no LVM devices file (/etc/lvm/devices/system.devices), so LVM sees every attached disk.
• Swap. The image has no swap. If your workload needs it, create a logical volume for it (for example sudo lvcreate -L 2G -n swap ol, then sudo mkswap /dev/ol/swap and an /etc/fstab entry), or use a swap file on / or /var.
• AIDE. The file integrity database is built from the image's own files, and the profile schedules aide --check daily at 04:05 from /etc/crontab.
• Postfix. Postfix is installed so local daemons can hand mail to root. It is disabled, and if you enable it, it listens on loopback only. sac-postfix-tls.service generates this instance's own Postfix TLS key and certificate at first boot, so no two instances share one.

The instance uses the standard Oracle Linux 9 repositories:

sudo dnf -q list --available nginx

Expected output (the versions change over time):

Available Packages nginx.x86_64 2:1.20.1-28.0.1.el9_8.6 ol9_appstream nginx.src 2:1.26.3-9.0.1.module+el9.8.0+91031+6e548d4b.4 ol9_appstream

Install and start software in the usual way, for example sudo dnf -y install nginx then sudo systemctl enable --now nginx. Then open its port in the security group and firewalld (Step 8). The AWS CLI is not on the image, so install the current version from AWS (the AWS CLI install guide) if you need it.

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys. The restorecon command gives the file the SELinux label that sshd expects.

The new account has no password, so sudo cannot authenticate it until you set one with sudo passwd alice. SSH stays key-only, and the password is used only by sudo. Password-free sudo is granted only to ec2-user, which cloud-init creates.