<blockquote>
<p>The pricing of these images says its $130/year (for software + AWS
usage): Does this mean running costs of EC2 are also covered in this
pricing?</p>
</blockquote>
<p>No.</p>
<p>If you read the details in the <a href="https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-ami-subscriptions.html" rel="nofollow noreferrer">AMI Subscription page</a>, it says in the last sentence:  &quot;Charges for using Amazon EC2 and other services from AWS are separate and <strong>in addition</strong> to what you pay to purchase AWS Marketplace software products.&quot;</p>
<p><a href="https://i.sstatic.net/Wb2aG.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Wb2aG.png" alt="enter image description here" /></a></p>
<blockquote>
<p>&quot;Also, is this pricing per instance? So if we need to use 100
instances, should we pay 13K per year?&quot;</p>
</blockquote>
<p>Yes.  In the same <a href="https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-ami-subscriptions.html" rel="nofollow noreferrer">AMI subscription page</a> from the first answer, it states:  &quot;You can apply one annual subscription to an AWS Marketplace software product <strong>to one Amazon EC2 instance</strong>&quot;</p>
<p>To find an estimate on total pricing, you need to go to the <a href="https://aws.amazon.com/marketplace/search/results?searchTerms=cis" rel="nofollow noreferrer">AWS Marketplace and filter for CIS</a>. You choose the AMI,  and click the cost details link.  Then choose region and the instance type and a total cost estimate for that instance is shown.</p>
<p><a href="https://i.sstatic.net/sSkYQ.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/sSkYQ.png" alt="enter image description here" /></a></p>
<blockquote>
<p>&quot;Are there scripts available to &quot;perform&quot; these hardening tasks on the
OS (to meet CIS hardening standards)?&quot;</p>
</blockquote>
<p>Yes with a cost.  They provide build kits if you are a member of the CIS SecureSuite.  But not for every operating system.  See the &quot;Leveraging Build Kits&quot; in <a href="https://aws.amazon.com/blogs/apn/how-to-decide-between-building-or-buying-a-cis-hardened-image/" rel="nofollow noreferrer">this article</a>.</p>

CC BY-SA 4.0
2021-11-12T09:28:37.063Z
Thanks much. Is there a place where we can get scripts which are used to harden OS images on AWS - say WIndows EC2 and Linux?
Biju
CC BY-SA 4.0
2021-11-12T15:41:31.667Z
try - https://security.stackexchange.com/
Taterhead
CC BY-SA 4.0
2021-11-09T15:42:32.730Z
2021-11-09T15:42:32.730Z
Taterhead
<p><a href="https://www.open-scap.org/getting-started/" rel="nofollow noreferrer">https://www.open-scap.org/getting-started/</a></p>
<p>Use OpenSCAP to scan and remediate, it has CIS level 1 and 2 server profiles.  I'm applying level 1 to my server, it's internal and level 1 leaves it quite usable.  I tried applying the general server profile and it broke the server.</p>

CC BY-SA 4.0
2023-08-01T15:43:33.720Z
2023-08-01T15:43:33.720Z
low351
<ul>
<li>CIS provides benchmarks for hardening OS on AWS</li>
<li>CIS also provides images which meet their own benchmarks above</li>
<li>These CIS images are available here - <a href="https://www.cisecurity.org/blog/everything-you-need-to-know-about-cis-hardened-images/" rel="nofollow noreferrer">https://www.cisecurity.org/blog/everything-you-need-to-know-about-cis-hardened-images/</a></li>
</ul>
<p>I have 2 questions:</p>
<ol>
<li>The pricing of these images says its $130/year (for software + AWS usage): Does this mean running costs of EC2 are also covered in this pricing? Also, is this pricing per instance? So if we need to use 100 instances, should we pay 13K per year?</li>
<li>Are there scripts available to &quot;perform&quot; these hardening tasks on the OS (to meet CIS hardening standards)?</li>
</ol>

<amazon-web-services><amazon-ec2><security>
Where to get OS Hardening Scripts for CIS Hardening Standards?
Biju
# Where to get OS Hardening Scripts for CIS Hardening Standards?

(Asked by: username_0 on 2021-11-08)

* CIS provides benchmarks for hardening OS on AWS
* CIS also provides images which meet their own benchmarks above
* These CIS images are available here - <https://www.cisecurity.org/blog/everything-you-need-to-know-about-cis-hardened-images/>

I have 2 questions:

1. The pricing of these images says its $130/year (for software + AWS usage): Does this mean running costs of EC2 are also covered in this pricing? Also, is this pricing per instance? So if we need to use 100 instances, should we pay 13K per year?
2. Are there scripts available to "perform" these hardening tasks on the OS (to meet CIS hardening standards)?

**Tags:** amazon-web-services, amazon-ec2, security


---

## 2 answers

### Answer by username_1 on 2021-11-09. Score: 1 | Accepted answer

> The pricing of these images says its $130/year (for software + AWS
> usage): Does this mean running costs of EC2 are also covered in this
> pricing?

No.

If you read the details in the [AMI Subscription page](https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-ami-subscriptions.html), it says in the last sentence: "Charges for using Amazon EC2 and other services from AWS are separate and **in addition** to what you pay to purchase AWS Marketplace software products."

[![enter image description here](https://i.sstatic.net/Wb2aG.png)](https://i.sstatic.net/Wb2aG.png)

> "Also, is this pricing per instance? So if we need to use 100
> instances, should we pay 13K per year?"

Yes. In the same [AMI subscription page](https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-ami-subscriptions.html) from the first answer, it states: "You can apply one annual subscription to an AWS Marketplace software product **to one Amazon EC2 instance**"

To find an estimate on total pricing, you need to go to the [AWS Marketplace and filter for CIS](https://aws.amazon.com/marketplace/search/results?searchTerms=cis). You choose the AMI, and click the cost details link. Then choose region and the instance type and a total cost estimate for that instance is shown.

[![enter image description here](https://i.sstatic.net/sSkYQ.png)](https://i.sstatic.net/sSkYQ.png)

> "Are there scripts available to "perform" these hardening tasks on the
> OS (to meet CIS hardening standards)?"

Yes with a cost. They provide build kits if you are a member of the CIS SecureSuite. But not for every operating system. See the "Leveraging Build Kits" in [this article](https://aws.amazon.com/blogs/apn/how-to-decide-between-building-or-buying-a-cis-hardened-image/).

> **Comments:**
> **username_0**: Thanks much. Is there a place where we can get scripts which are used to harden OS images on AWS - say WIndows EC2 and Linux?  
> **username_1**: try - https://security.stackexchange.com/  

---

### Answer by username_2 on 2023-08-01. Score: 1

<https://www.open-scap.org/getting-started/>

Use OpenSCAP to scan and remediate, it has CIS level 1 and 2 server profiles. I'm applying level 1 to my server, it's internal and level 1 leaves it quite usable. I tried applying the general server profile and it broke the server.


---

