Hardened Rocky Linux 10(ARM64) Latest

This is a repackaged open source software product wherein additional charges apply for a pre-hardened, AWS-optimized image with verifiable compliance evidence and maintenance. Based on Rocky Linux 10.2 ARM64, this AMI is hardened following Red Hat STIG guidelines, tuned for Amazon EC2 workloads, and equipped with a complete OpenSCAP evidence pack and Software Bill of Materials (SBOM).

Security & Compliance:

1. Red Hat STIG Alignment: 356 security controls applied via the SCAP Security Guide, including auditd logging, SSH hardening, kernel command line and module blocklist restrictions, and strict password policy enforcement.

2. Fully Patched at Release: Zero packages with a pending update at build time, verified. The complete CVE scan ships inside the image.

3. Comprehensive Evidence Pack: Every AMI includes an OpenSCAP evidence pack generated against Red Hat STIG guidance for Rocky Linux 10.2, located under /opt/hardening-report/:

   • Base_Report.html: Pre-hardening OpenSCAP scan report representing the initial baseline.
   • Tailored_Profile_Report.html: Post-hardening scan report evaluated against the tailored profile shipped inside this image.
   • Raw_STIG_Report.html: Post-hardening scan report evaluated against the unmodified baseline Red Hat STIG profile.
   • Exceptions.txt: Itemized list of unapplied STIG rules along with technical justifications (AWS compatibility, site-specific policies, CSP service conflicts).
   • Tuning_Parameters.txt: Every performance tuning parameter applied on top of the hardening, each shown against its base-image value.
   • compliance_mapping.csv: Rule-by-rule mapping to NIST SP 800-53 controls and Red Hat STIG identifiers with pass/fail statuses.
   • package_changes.txt: Package delta report comparing the final image against the minimal stock installation.
   • sbom.spdx.json: Software Bill of Materials (SBOM) in SPDX format generated from the RPM database.
   • cve_scan.txt / cve_scan_full.txt.gz: Vulnerability scan reports categorizing CVEs by upstream patch availability.
   • key_files.sha256: SHA-256 checksums of the key configuration files changed by the hardening, so the delivered state can be verified.
   • README.txt: Index file detailing artifact contents, administrative operational guidelines, and configuration defaults.

System Footprint & Reliability Optimization:

1. Minimal Footprint: Built on a minimal OS installation to reduce the attack surface and remove unnecessary packages.

2. Storage Layout: Configured with a streamlined 10 GB root (/) partition layout to minimize disk footprint while ensuring core system operation.

3. Validation Testing: Functional verification conducted on clean AMI launches through multi-round integration testing, verifying complete software lifecycle operations with SELinux enforcing.

AWS Network & Kernel Tuning:

1. Network Stack: TCP BBR congestion control with fair queueing, increased connection backlogs, buffer adjustments, and MTU probing enabled.

2. System Tuning: Red Hat tuned daemon active with a custom cloud profile, custom transparent hugepages (madvise), and modified memory/EBS writeback parameters.

3. EC2 Integration: Configured with NVMe I/O timeouts, Amazon Time Sync (chrony), IRQ balance daemon, and size-capped persistent journald logging.

Operational Tools

1. Preinstalled Tools: AWS SSM Session Manager enabled, CloudWatch Agent installed (disabled by default).

Maintenance:

1. Maintenance Specifications: Rebuilt and updated bi-weekly to monthly incorporating upstream Rocky Linux 10.2 security updates, updated artifact documentation per release, and administrative documentation.

About Rocky Linux 10 ARM64

1. Rocky Linux 10 Foundation: A 100% bug-for-bug compatible, enterprise-grade derivative of Red Hat Enterprise Linux (RHEL). Serving as the premier downstream alternative to traditional CentOS, it provides a clean, bloat-free, and secure foundation with exceptional ecosystem compatibility for AlmaLinux and other RHEL-based workloads.

2. Next-Generation Enterprise Platform: Rebuilt from RHEL 10 sources, Rocky Linux 10 carries the newest enterprise kernel and toolchain of the Red Hat lineage while preserving the binary compatibility the ecosystem depends on. Applications certified for RHEL 10 run without modification, giving teams a forward-looking base with a long maintenance horizon.