Skip the Hardening Overhead. Deploy DISA STIG Compliant AMIs.
We are a cloud-native security company providing turnkey, pre-hardened Amazon Machine Images (AMIs) configured strictly according to official DISA STIG benchmarks—saving your engineering teams weeks of tedious compliance configuration and audit frustration.
Our AMIs are pre-hardened to satisfy most DISA STIG controls out of the box (~90%+ total coverage). Post-deployment steps (such as configuring site-specific syslog targets, setting grub passwords, and firewall ports) are detailed in our Technical Guides.
Why Choose The Blue Picket Fence?
Built for Security Engineers, Loved by DevOps
Achieving DISA STIG compliance manually requires hundreds of shell scripts, complex PAM configurations, kernel hardening, and ongoing auditing. We eliminate that burden.
DISA STIG Compliant
Every image is built using automated pipelines aligned directly with Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs).
Saves Time & Aggravation
Skip hundreds of hours spent testing broken dependencies, locked-out root users, and custom audit rules. Launch pre-hardened servers in minutes.
Regularly Updated
Our image pipeline continuously pulls upstream OS security patches and incorporates updated STIG benchmark revisions so your deployments remain audit-ready.
OUR MISSION
Secure Baselines Without the Deployment Friction
At The Blue Picket Fence, we specialize in cloud security automation for organizations operating under rigorous compliance standards like FedRAMP, DoD CC SRG, and HIPAA. We take the pain out of infrastructure hardening so you can focus on building applications, not troubleshooting locked-down operating systems.
AWS
Native Integration
DISA
Benchmark Standards
Minimal
Manual Setup Needed
Need Post-Launch Setup?
Our images come pre-hardened, but you'll still need to configure user credentials, extend EBS volumes, or set up remote logging.
Catalog & AWS Marketplace
Pre-Hardened Amazon Machine Images
Explore our catalog of DISA STIG hardened server templates available directly on the AWS Marketplace. Ready for immediate deployment in EC2.
RHEL 8
STIG Benchmark V2
Red Hat Enterprise Linux 8
DISA STIG Hardened - Enterprise Edition
Pre-configured RHEL 8 AMI hardened to meet DoD DISA STIG standards. Includes FIPS compliance mode readiness, encrypted partitions, and auditing defaults.
Next-generation RHEL 9 platform fully hardened against DISA STIG guidelines. Optimized for enterprise workloads requiring high security and compliance.
AWS native Amazon Linux 2023 image tuned for cloud performance and hardened to comply with DISA STIG rules, including SELinux enforcement and PAM rules.
While our AMIs are fully hardened out-of-the-box, certain system settings—such as expanding EBS volumes, setting passwords, and configuring logging endpoints—must be performed post-launch.
STORAGE MANAGEMENT
How to Enlarge EBS Root & Data Volumes
Extending file system partitions on hardened Linux kernel images (XFS and EXT4)
When you launch an EC2 instance using our pre-hardened AMIs with an EBS volume larger than the default AMI snapshot size (e.g., launching a 100 GiB volume on a 20 GiB default image), the operating system partition must be expanded to utilize the newly available block storage.
1
Check Current Disk Space & Block Devices
Run lsblk and df -h to identify your root partition (typically /dev/nvme0n1p1 or /dev/xvda1):
lsblk
df -hT
2
Grow the Partition with growpart
Use the growpart tool to extend partition 1 on the disk block device:
# For NVMe instances (Amazon Linux 2023, RHEL 8/9/10):
sudo growpart /dev/nvme0n1 1
# For standard Xen virtual disks:
sudo growpart /dev/xvda 1
3
Resize the Filesystem
Depending on whether your hardened image uses XFS (RHEL, AL2023 default) or EXT4 (Ubuntu default):
# For XFS File Systems (RHEL / AL2023):
sudo xfs_growfs -d /
# For EXT4 File Systems (Ubuntu):
sudo resize2fs /dev/nvme0n1p1
STIG Compliance Note: DISA STIG guidelines require separate mounts for /var, /var/log, /var/log/audit, and /tmp. If you are extending a specific sub-partition, substitute / with the corresponding mount path.
To enforce strict DISA STIG requirements, password authentication for SSH is disabled by default in our images, and root login via SSH is completely forbidden.
1
Setting Local Administrative Passwords
To assign a password to ec2-user or root that satisfies PAM complexity rules (minimum 15 characters, uppercase, lowercase, special characters, numbers):
Forwarding audit logs & syslog entries to central SIEM or CloudWatch Logs
DISA STIG control AU-9 mandates that audit records and system logs be offloaded immediately to a central syslog repository or security monitoring system to prevent local log tampering.
1
Configuring Rsyslog Remote Forwarding
Edit /etc/rsyslog.d/50-remote.conf to direct encrypted log streams to your central syslog server:
Our images come pre-installed with the AWS CloudWatch Agent. Simply apply your JSON configuration:
# Start CloudWatch Agent using SSM or local config file
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
-a fetch-config \
-m ec2 \
-c file:/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json \
-s
CRYPTOGRAPHY
FIPS Mode & Cryptographic Verification
Verifying FIPS 140-2/140-3 module status on hardened server kernels
All Blue Picket Fence enterprise Linux images (RHEL 8, RHEL 9, RHEL 10, AL2023) are pre-configured to operate with FIPS-validated cryptographic modules.
1
Verify System FIPS Enforcement
Confirm that the Linux kernel is enforcing FIPS mode using the sysctl or fips-mode-setup tool:
# Check kernel FIPS flag (Expected output: 1)
cat /proc/sys/crypto/fips_enabled
# For RHEL distributions:
fips-mode-setup --check
