Rocky Linux 8 Minimal

Option A: Azure Portal

• Open the Azure Marketplace and search for "Rocky Linux 8 Minimal SecureAnyCloud".
• Select the image and click Create.
• On the Basics tab, set Subscription to your Azure subscription.
• Set Resource Group to a new or existing group.
• Enter a Virtual Machine Name.
• Pick your preferred Region.
• Set Size to Standard_B2s (recommended).
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:rocky-8-minimal:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-rocky-8-minimal-vm \
  --image sac1647283583153:rocky-8-minimal:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-rocky-8-minimal-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

Check the Rocky Linux release and package count:

cat /etc/rocky-release grep -E '^(NAME|VERSION|ID|PLATFORM_ID)=' /etc/os-release uname -rm rpm -qa | wc -l

Expected output:

Rocky Linux release 8.10 (Green Obsidian) NAME="Rocky Linux" VERSION="8.10 (Green Obsidian)" ID="rocky" PLATFORM_ID="platform:el8" 4.18.0-553.153.1.el8_10.x86_64 x86_64 425

This listing follows the Rocky 8 stream. It ships whichever 8.x point release is current when the image is built, instead of being pinned to a single minor release like the SecureAnyCloud Rocky Linux 8.10 image. Release 8.10 is the final minor of the RHEL 8 lifecycle, so both images report the same release string today. This one would keep following the stream if that ever changed.

The image is fully updated at build time. The command dnf check-update returns exit code 100 when updates are pending and 0 when none are:

sudo dnf check-update echo "check-update exit code: $?"

Confirm that no reboot is outstanding. The command needs-restarting -r returns 0 when nothing requires a restart:

sudo dnf needs-restarting -r echo "needs-restarting exit code: $?"

List the enabled repositories to confirm your update path is intact:

dnf repolist --enabled

Expected output:

repo id repo name appstream Rocky Linux 8 - AppStream baseos Rocky Linux 8 - BaseOS extras Rocky Linux 8 - Extras

PowerTools (powertools) is not enabled on this image. It carries developer and build-time packages that most server workloads do not need. Check its state:

echo "powertools state: $(dnf repolist --all 2>/dev/null | grep -c '^powertools ')"

To turn it on, run sudo dnf config-manager --set-enabled powertools. RHEL 9 renamed this repository to crb, but on this RHEL 8-compatible image the name is still powertools.

Package signatures are verified on every install: no repository on this image sets gpgcheck=0.

This image ships patched and keeps patching itself. dnf-automatic is installed and configured to apply updates. Its timer is enabled, so systemd starts it automatically on every boot:

systemctl is-enabled dnf-automatic.timer
systemctl is-active dnf-automatic.timer grep -E '^(upgrade_type|download_updates|apply_updates)' /etc/dnf/automatic.conf

Expected output:

enabled active upgrade_type = default download_updates = yes apply_updates = yes

upgrade_type is deliberately set to default rather than security. The security-only mode resolves against errata metadata. Where that metadata is not published, a security-only policy silently resolves to nothing and applies no updates. The default setting applies every available update, so it cannot quietly do nothing.

To control the schedule yourself, disable the timer and patch on your own cadence:

echo "to take manual control: sudo systemctl disable --now dnf-automatic.timer"

To patch by hand at any time, run sudo dnf upgrade -y, then reboot with sudo systemctl reboot if a new kernel was installed.

Confirm that SELinux is enforcing with its policy loaded, root is locked, SSH is key-only and there is no swap:

getenforce sestatus | grep -E '^(SELinux status|Loaded policy name|Current mode)' grep -E '^[[:space:]]*SELINUX=' /etc/selinux/config
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication)' swapon --show

Expected output:

Enforcing SELinux status: enabled Loaded policy name: targeted Current mode: enforcing SELINUX=enforcing root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.) permitrootlogin without-password passwordauthentication no kbdinteractiveauthentication no

The command swapon --show returns nothing. This is expected (see Step 7).

without-password is how OpenSSH reports the prohibit-password setting. Both names mean the same thing: root may not authenticate with a password.

The checks cover both the runtime SELinux mode and the persisted /etc/selinux/config value, because a runtime setting that is not persisted would silently revert on your next reboot. The sestatus policy name confirms the policy is loaded, not merely that the runtime mode reads Enforcing.

Confirm that the Azure Linux Agent, cloud-init and time synchronization are healthy, and check your resources:

systemctl is-active waagent
systemctl is-enabled waagent cloud-init --version
systemctl is-active chronyd df -h / free -h

The command free -h reports 0B of swap. This is deliberate. Azure manages swap on the ephemeral resource disk through waagent rather than on the OS disk, and a swap file baked into a Marketplace image fails certification. If your workload needs swap, configure it through waagent.

The Azure Network Security Group controls inbound and outbound traffic. It is the first, and usually the only, place you need to open a port.

This image is a Minimal build, so firewalld is not installed. This is deliberate. With no host firewall in the way, your NSG rules take effect exactly as written, and there is no second layer to keep in sync. Confirm what is listening before you open anything:

sudo ss -tlnu

On a fresh machine, SSH on port 22 is the only externally bound listener. Chrony appears on 127.0.0.1:323 and [::1]:323, both loopback only and not reachable from the network.

rpcbind is disabled on this image. The stock Rocky cloud image pulls it in because nfs-utils depends on it, which leaves TCP and UDP port 111 open on every interface. NFSv4, the default in Rocky Linux 8, does not use rpcbind. This image therefore disables it and closes the port, while nfs-utils stays installed and fully working for NFSv4 mounts:

echo "rpcbind.socket: $(systemctl is-enabled rpcbind.socket 2>/dev/null || echo disabled)" rpm -q nfs-utils

NFSv3 does require the portmapper. If you need it, turn rpcbind back on with one command:

echo "to re-enable NFSv3 support: sudo systemctl enable --now rpcbind.socket"

rpcbind is disabled rather than masked, so that command works without further steps.

If your policy also requires a host firewall, install and enable it yourself:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Once firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service.

This is the same Rocky Linux 8 base as the standard SecureAnyCloud images, with the packages a headless Azure guest never uses removed. Confirm the trim yourself:

rpm -qa cockpit-ws cockpit-bridge tuned sos plymouth linux-firmware echo "(no output above = every trimmed package is genuinely absent)"

Removed Why it is safe to remove on Azure

linux-firmware Firmware blobs for physical NICs, GPUs, wireless and storage controllers. An Azure guest's storage and network are the in-kernel Hyper-V synthetic drivers, which load no firmware at all. This is the single largest reduction.

cockpit-ws, cockpit-bridge The web admin console. This is a headless server image with no web UI.

tuned The tuning-profile daemon. Azure images use the platform defaults.

sos The Red Hat support-report collector. Install it yourself if you need it for a support case.

plymouth The graphical boot splash. There is no console to splash to on a cloud VM.

GeoIP data files A bundled dataset unused on a base OS image.

Nothing the platform needs is touched: systemd, NetworkManager, openssh-server, cloud-init, WALinuxAgent, dnf, sudo, chrony and dnf-automatic all ship exactly as on the standard image. Every removal above is verified on the image before it is captured. SELinux and its policy package are asserted present at every stage of the build, so a trim that touches the wrong dependency chain cannot ship silently.

AppStream carries the application packages. Search it, then install what you need:

dnf search nginx

The 8 series still ships modules for some packages. AppStream can carry several versions of the same language or database as separate streams, so you can pick a version instead of taking the default.

dnf module list nginx

Expected output:

Rocky Linux 8 - AppStream Name Stream Profiles Summary nginx 1.14 [d] common [d] nginx webserver nginx 1.16 common [d] nginx webserver nginx 1.18 common [d] nginx webserver nginx 1.20 common [d] nginx webserver nginx 1.22 common [d] nginx webserver nginx 1.24 common [d] nginx webserver Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled

Install a package and enable it in the usual way, for example sudo dnf install -y nginx followed by sudo systemctl enable --now nginx.

To add another administrator, create the account with sudo adduser <name>. Add it to the wheel group with sudo usermod -aG wheel <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys, with mode 600 on the file and mode 700 on the .ssh directory, both owned by that user.

The image ships with no human accounts, so azureuser is the only login until you add one:

getent group wheel

Option A: AWS Marketplace console

• Open the SecureAnyCloud Rocky Linux listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Once the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for full control), then in Version choose Rocky Linux 8 Minimal - YYYY-MM-DD (the date is when the version was added) and your Region.
• Instance type: m5.large is recommended; any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
• Key pair: choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.
• Security group: allow inbound TCP 22 from your own IP address or network only.
• Storage: the root volume is 11 GiB gp3 by default. Choose a larger size if you need one; cloud-init grows the root partition and filesystem to fill it on first boot.
• Metadata: leave the defaults. The image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the key pair, security group and subnet with your own. The root device of this AMI is /dev/sda1:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rocky-linux-8-minimal}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

From your workstation, connect as rocky with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem rocky@<public-ip>

There is no password to enter. If SSH asks for one, or says Too many authentication failures, see Troubleshooting below.

You can also connect without opening port 22 through AWS Systems Manager Session Manager, if the instance has an instance profile that allows Systems Manager. The agent is installed and running on this image.

cat /etc/rocky-release grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release uname -srm

Expected output:

Rocky Linux release 8.10 (Green Obsidian) NAME="Rocky Linux" VERSION="8.10 (Green Obsidian)" ID="rocky" VERSION_ID="8.10" PLATFORM_ID="platform:el8" PRETTY_NAME="Rocky Linux 8.10 (Green Obsidian)" Linux 4.18.0-553.176.1.el8_10.x86_64 x86_64

Rocky Linux 8.10 is the final minor release of Rocky Linux 8. Updates keep arriving through normal dnf updates until Rocky Linux 8 reaches its end of life in 2029. Your kernel version may be newer if updates were installed after the image was built.

The image lists exactly what was removed. Anything that a removal would have taken with it is kept and listed instead:

cat /usr/share/doc/sac/minimal-manifest.txt

Expected output:

Minimal version: packages 484 -> 428 Removed: linux-firmware geolite2-city geolite2-country cockpit-ws cockpit-system tuned Kept (a removal would have taken a protected package, or it failed):

The trim takes the package count from 484 to 428. The six named packages are the ones the trim asked for. The other 50 were installed only as part of those stacks and left with them, among them PackageKit, sos, setroubleshoot, policycoreutils-python-utils, cockpit-bridge, dmidecode, virt-what, the Rocky Linux logo artwork and the font and graphics libraries only they used. Nothing had to be kept back.

After the trim, the CIS remediation adds the tools it needs (OpenSCAP, AIDE, systemd-journal-remote and their libraries), so a new instance has 439 packages. The count moves by a few as kernels and updates install.

The kdump crash-dump service (kexec-tools) stays installed and enabled, as on a standard Rocky Linux 8 system. Anything removed is one sudo dnf install away from the standard Rocky Linux repositories, for example sudo dnf -y install sos if a support case asks for an sos report, sudo dnf -y install tuned if you want tuning profiles, or sudo dnf -y install policycoreutils-python-utils for the semanage SELinux tool (see Troubleshooting).

The image ships the evaluation that the build ran after its reboot. List the files:

ls -lh /usr/share/doc/sac/ python3 -c "import json; s=json.load(open('/usr/share/doc/sac/cis-l1-summary.json')); print('profile: ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived: ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 40M -rw-r--r--. 1 root root 37M Oct 21 10:37 cis-l1-arf.xml -rw-r--r--. 1 root root 2.5M Oct 21 10:37 cis-l1-report.html -rw-r--r--. 1 root root 1.2K Oct 21 10:37 cis-l1-summary.json -rw-r--r--. 1 root root 2.0K Oct 21 10:37 cis-l1-tailoring.xml -rw-r--r--. 1 root root 3.2K Oct 21 10:37 cis-l1-waivers.txt -rw-r--r--. 1 root root 205 Oct 21 10:29 minimal-manifest.txt -rw-r--r--. 1 root root 1.6K Oct 21 10:30 scap-security-guide-LICENSE.txt profile: CIS Level 1 Server (SCAP Security Guide 0.1.82) scored rules: 294 pass: 294 fail: 0 rate: 100.0% waived: 8 not applicable: 38 evaluated at: 2026-10-21T10:37:58Z

• cis-l1-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• cis-l1-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• cis-l1-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not selected, or waived are not counted.

To copy the report, run this on your workstation:

scp -i ~/.ssh/my-key-pair.pem rocky@<public-ip>:/usr/share/doc/sac/cis-l1-report.html .

The eight waived rules

grep -v '^#' /usr/share/doc/sac/cis-l1-waivers.txt | cut -f1,2

Expected output:

partition_for_tmp [single-volume-partitions] grub2_password [serial-console-and-boot] grub2_uefi_password [serial-console-and-boot] ensure_root_password_configured [serial-console-and-boot] accounts_maximum_age_login_defs [key-only-account-aging] account_disable_post_pw_expiration [key-only-account-aging] sshd_limit_user_access [ssh-access-list] service_systemd-journal-upload_enabled [log-remote-destination]

The third column of the same file gives the full reason for each waiver. In short:

• Separate /tmp partition: this version boots from one EBS root volume. (The Rocky Linux 8 LVM version of this listing provides separate volumes for /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home, and scores those rules.)
• Boot loader and root passwords: a GRUB or root password would have to be baked into the image, giving every instance the same secret. Root stays locked with no password. Set your own if you need serial console access (see Step 11).
• Password ageing defaults: the accounts cloud-init creates are key-only. An ageing limit would expire them and lock the SSH key out. Accounts that do have a password are still aged.
• SSH AllowUsers/AllowGroups: a list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.
• Remote journal upload: the benchmark switches on systemd-journal-upload, which sends the system journal to a remote log server, but the image cannot know your log server. Switched on with no destination, the service fails at every boot. systemd-journal-remote is installed and the upload service is left off; to use it, see "Send the journal to your own log server" below.

Every scored rule passes

python3 -c "import json; print(json.load(open('/usr/share/doc/sac/cis-l1-summary.json'))['failingRules'])"

Expected output:

[]

The list of failing rules is empty: every rule the profile scores on this image passes. Rules that do not apply to an EC2 instance (for example wireless interfaces) are reported as not applicable and are not counted.

Send the journal to your own log server

If you run a systemd-journal-remote collector, point the image at it and switch the upload service on (replace the address with your collector's):

echo 'URL=https://logs.example.internal:19532' | sudo tee -a /etc/systemd/journal-upload.conf
sudo systemctl enable --now systemd-journal-upload

Repeat the evaluation at any time with the same content and tailoring. It takes about a minute:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/sac/cis-l1-tailoring.xml \
  --profile xccdf_co.sac_profile_cis-l1_ec2_single \
  --results /tmp/cis-check-results.xml --report /tmp/cis-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rl8-ds.xml > /tmp/cis-check.log 2>&1 echo "oscap exit code: $? (0 = every rule passed, 2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/cis-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 0 (0 = every rule passed, 2 = at least one rule did not pass) {'notapplicable': 38, 'notselected': 1369, 'pass': 294} pass rate: 100.0%

Your own report is at /tmp/cis-check-report.html. As you install software and change settings, re-run the evaluation to see how your changes affect the result.

Use ssg-rl8-ds.xml, Rocky Linux's own content. The package also ships ssg-rhel8-ds.xml, whose rules apply only to Red Hat Enterprise Linux and would all report as not applicable here.

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401 us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2. Every current AWS SDK and the AWS CLI do this automatically.

sudo firewall-cmd --state sudo firewall-cmd --list-all sudo ss -tlnp

Expected output:

running public (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: dhcpv6-client ssh ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=949,fd=3)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=949,fd=4))

• Only sshd listens, on port 22. Nothing else on the image opens a TCP port.
• The public zone allows ssh and dhcpv6-client (replies to the instance's IPv6 DHCP client, which is how an instance in an IPv6-enabled subnet gets its address). The Rocky Linux default cockpit service is removed from the zone; Cockpit is not installed.

To open a port for your own service, allow it in both the instance's security group and firewalld. For example, for a web server on 443, run this on the instance:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld, or the other way round, the traffic will not arrive.

systemctl is-active chronyd amazon-ssm-agent chronyc -n sources

Expected output (the pool servers and timings vary):

active active MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^- 172.235.60.8 2 6 77 29 +106us[ +112us] +/- 28ms ^- 144.202.66.214 2 6 77 29 +88us[ +94us] +/- 23ms ^- 23.186.168.132 2 6 77 29 -302us[ -296us] +/- 54ms ^- 68.183.147.240 3 6 77 28 +1656us[+1662us] +/- 12ms ^* 169.254.169.123 3 4 377 13 +6087ns[ +13us] +/- 498us

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public Rocky Linux pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's own package at its current release (3.3.5390.0 on this build). It is not in the Rocky Linux repositories, so dnf does not update it. Systems Manager can keep it current for you, through the AWS-UpdateSSMAgent document or the Auto update SSM Agent setting in Fleet Manager.

The image is fully patched at build time. Check which updates are pending now:

sudo dnf -q check-update --refresh echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)" grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer uname -r

Expected output on an instance launched soon after the image was built (later launches list the updates released since, with exit code 100):

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available) upgrade_type = security apply_updates = yes enabled 4.18.0-553.176.1.el8_10.x86_64

dnf-automatic runs daily (06:00, with a random delay of up to an hour) and installs security updates automatically. To update everything now, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval|banner|authorizedkeyscommand) ' cat /etc/issue.net rpm -q --quiet ec2-instance-connect && echo "EC2 Instance Connect: installed" || echo "EC2 Instance Connect: not installed"
sudo ls -l /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_rsa_key

Expected output (the host key dates are your instance's first boot):

Enforcing root LK 2026-06-26 0 99999 7 -1 (Password locked.) maxauthtries 4 clientaliveinterval 300 permitrootlogin no pubkeyauthentication yes passwordauthentication no banner /etc/issue.net authorizedkeyscommand none Authorized users only. All activity may be monitored and reported. EC2 Instance Connect: not installed -rw-------. 1 root ssh_keys 537 Oct 20 06:24 /etc/ssh/ssh_host_ecdsa_key -rw-------. 1 root ssh_keys 432 Oct 20 06:24 /etc/ssh/ssh_host_ed25519_key -rw-------. 1 root ssh_keys 2635 Oct 20 06:24 /etc/ssh/ssh_host_rsa_key

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on; if your own software is denied, check sudo ausearch -m avc -ts recent rather than disabling SELinux.
• LK means the root account is locked.
• maxauthtries 4 and clientaliveinterval 300 come from the CIS profile: SSH allows four authentication attempts per connection and checks idle sessions every five minutes.
• authorizedkeyscommand none: SSH reads keys only from each user's authorized_keys file.
• The banner text is shown before login.
• The SSH host keys are created on your instance's first boot and are readable by root only (-rw-------). Rocky Linux creates them group-readable by ssh_keys; a small boot service, sac-sshd-hostkey-perms.service, tightens them to 0600 before the SSH server starts, which is what the CIS rule for host key permissions checks.

EC2 Instance Connect is not installed, so your key pair is the only SSH credential. Use Session Manager (Step 2) for browser-based access.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. For serial console access, set a password for your own user on your running instance. The password is yours and is never on the image:

sudo passwd rocky

df -hT /
sudo grep -E 'cc_growpart.*(resized|NOCHANGE)' /var/log/cloud-init.log | tail -1 swapon --noheadings --show | wc -l sudo grep -h aide /etc/crontab

Expected output with the default 11 GiB root volume (on a larger volume, Size is larger and the cloud-init line says resized):

Filesystem Type Size Used Avail Use% Mounted on /dev/nvme0n1p5 xfs 10G 2.1G 7.9G 21% / 2026-10-21 11:06:06,543 - cc_growpart.py[DEBUG]: '/' NOCHANGE: no change necessary (/dev/nvme0n1, 5) 0 05 4 * * * root /usr/sbin/aide --check

• Disk layout. The root filesystem is XFS on partition 5 of the root volume; /boot (XFS) and /boot/efi are separate small partitions.
• Disk growth. cloud-init grows the root partition and filesystem to the volume size on first boot. To grow later, increase the EBS volume size in the console or with aws ec2 modify-volume, then run sudo growpart /dev/nvme0n1 5 && sudo xfs_growfs / (or reboot).
• Swap. The image has no swap. Add a swap file yourself if your workload needs one.
• AIDE. The file integrity database is built from the image's own files, and the CIS profile schedules aide --check daily at 04:05 from /etc/crontab.

The instance uses the standard Rocky Linux 8 repositories (BaseOS, AppStream and Extras):

sudo dnf -q list --available nginx

Expected output (the version changes over time):

Available Packages nginx.x86_64 1:1.14.1-9.module+el8.4.0+542+81547229 appstream

Rocky Linux 8 ships several versions of some software as application streams (for example sudo dnf module list nginx); sudo dnf module enable nginx:1.24 before installing picks a newer stream. Install and start software in the usual way, for example sudo dnf -y install nginx then sudo systemctl enable --now nginx, and open its port in the security group and firewalld (Step 8). The AWS CLI is not on the image; install the current version from AWS (the AWS CLI install guide) if you need it.

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys, and restorecon gives the file the SELinux label that sshd expects. The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice. SSH stays key-only, and sudo uses the password. Only rocky, created by cloud-init, has password-free sudo.