Answers: <blockquote>
  <p>The pricing of these images says its $130/year (for software + AWS
  usage): Does this mean running costs of EC2 are also covered in this
  pricing?</p>
  </blockquote>
  <p>No.</p>
  <p>If you read the details in the <a href="https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-ami-subscriptions.html" rel="nofollow noreferrer">AMI Subscription page</a>, it says in the last sentence:  &quot;Charges for using Amazon EC2 and other services from AWS are separate and <strong>in addition</strong> to what you pay to purchase AWS Marketplace software products.&quot;</p>
  <p><a href="https://i.sstatic.net/Wb2aG.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Wb2aG.png" alt="enter image description here" /></a></p>
  <blockquote>
  <p>&quot;Also, is this pricing per instance? So if we need to use 100
  instances, should we pay 13K per year?&quot;</p>
  </blockquote>
  <p>Yes.  In the same <a href="https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-ami-subscriptions.html" rel="nofollow noreferrer">AMI subscription page</a> from the first answer, it states:  &quot;You can apply one annual subscription to an AWS Marketplace software product <strong>to one Amazon EC2 instance</strong>&quot;</p>
  <p>To find an estimate on total pricing, you need to go to the <a href="https://aws.amazon.com/marketplace/search/results?searchTerms=cis" rel="nofollow noreferrer">AWS Marketplace and filter for CIS</a>. You choose the AMI,  and click the cost details link.  Then choose region and the instance type and a total cost estimate for that instance is shown.</p>
  <p><a href="https://i.sstatic.net/sSkYQ.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/sSkYQ.png" alt="enter image description here" /></a></p>
  <blockquote>
  <p>&quot;Are there scripts available to &quot;perform&quot; these hardening tasks on the
  OS (to meet CIS hardening standards)?&quot;</p>
  </blockquote>
  <p>Yes with a cost.  They provide build kits if you are a member of the CIS SecureSuite.  But not for every operating system.  See the &quot;Leveraging Build Kits&quot; in <a href="https://aws.amazon.com/blogs/apn/how-to-decide-between-building-or-buying-a-cis-hardened-image/" rel="nofollow noreferrer">this article</a>.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-11-12T09:28:37.063Z
Answers: Thanks much. Is there a place where we can get scripts which are used to harden OS images on AWS - say WIndows EC2 and Linux?
Answers: Biju
Answers: CC BY-SA 4.0
Answers: 2021-11-12T15:41:31.667Z
Answers: try - https://security.stackexchange.com/
Answers: Taterhead
Answers: CC BY-SA 4.0
Answers: 2021-11-09T15:42:32.730Z
Answers: 2021-11-09T15:42:32.730Z
Answers: Taterhead
Answers: <p><a href="https://www.open-scap.org/getting-started/" rel="nofollow noreferrer">https://www.open-scap.org/getting-started/</a></p>
  <p>Use OpenSCAP to scan and remediate, it has CIS level 1 and 2 server profiles.  I'm applying level 1 to my server, it's internal and level 1 leaves it quite usable.  I tried applying the general server profile and it broke the server.</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-08-01T15:43:33.720Z
Answers: 2023-08-01T15:43:33.720Z
Answers: low351
Body: <ul>
  <li>CIS provides benchmarks for hardening OS on AWS</li>
  <li>CIS also provides images which meet their own benchmarks above</li>
  <li>These CIS images are available here - <a href="https://www.cisecurity.org/blog/everything-you-need-to-know-about-cis-hardened-images/" rel="nofollow noreferrer">https://www.cisecurity.org/blog/everything-you-need-to-know-about-cis-hardened-images/</a></li>
  </ul>
  <p>I have 2 questions:</p>
  <ol>
  <li>The pricing of these images says its $130/year (for software + AWS usage): Does this mean running costs of EC2 are also covered in this pricing? Also, is this pricing per instance? So if we need to use 100 instances, should we pay 13K per year?</li>
  <li>Are there scripts available to &quot;perform&quot; these hardening tasks on the OS (to meet CIS hardening standards)?</li>
  </ol>
  
Tags: <amazon-web-services><amazon-ec2><security>
Title: Where to get OS Hardening Scripts for CIS Hardening Standards?
UserDisplayName: Biju
ThreadText: # Where to get OS Hardening Scripts for CIS Hardening Standards?
  
  (Asked by: username_0 on 2021-11-08)
  
  * CIS provides benchmarks for hardening OS on AWS
  * CIS also provides images which meet their own benchmarks above
  * These CIS images are available here - <https://www.cisecurity.org/blog/everything-you-need-to-know-about-cis-hardened-images/>
  
  I have 2 questions:
  
  1. The pricing of these images says its $130/year (for software + AWS usage): Does this mean running costs of EC2 are also covered in this pricing? Also, is this pricing per instance? So if we need to use 100 instances, should we pay 13K per year?
  2. Are there scripts available to "perform" these hardening tasks on the OS (to meet CIS hardening standards)?
  
  **Tags:** amazon-web-services, amazon-ec2, security
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2021-11-09. Score: 1 | Accepted answer
  
  > The pricing of these images says its $130/year (for software + AWS
  > usage): Does this mean running costs of EC2 are also covered in this
  > pricing?
  
  No.
  
  If you read the details in the [AMI Subscription page](https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-ami-subscriptions.html), it says in the last sentence: "Charges for using Amazon EC2 and other services from AWS are separate and **in addition** to what you pay to purchase AWS Marketplace software products."
  
  [![enter image description here](https://i.sstatic.net/Wb2aG.png)](https://i.sstatic.net/Wb2aG.png)
  
  > "Also, is this pricing per instance? So if we need to use 100
  > instances, should we pay 13K per year?"
  
  Yes. In the same [AMI subscription page](https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-ami-subscriptions.html) from the first answer, it states: "You can apply one annual subscription to an AWS Marketplace software product **to one Amazon EC2 instance**"
  
  To find an estimate on total pricing, you need to go to the [AWS Marketplace and filter for CIS](https://aws.amazon.com/marketplace/search/results?searchTerms=cis). You choose the AMI, and click the cost details link. Then choose region and the instance type and a total cost estimate for that instance is shown.
  
  [![enter image description here](https://i.sstatic.net/sSkYQ.png)](https://i.sstatic.net/sSkYQ.png)
  
  > "Are there scripts available to "perform" these hardening tasks on the
  > OS (to meet CIS hardening standards)?"
  
  Yes with a cost. They provide build kits if you are a member of the CIS SecureSuite. But not for every operating system. See the "Leveraging Build Kits" in [this article](https://aws.amazon.com/blogs/apn/how-to-decide-between-building-or-buying-a-cis-hardened-image/).
  
  > **Comments:**
  > **username_0**: Thanks much. Is there a place where we can get scripts which are used to harden OS images on AWS - say WIndows EC2 and Linux?  
  > **username_1**: try - https://security.stackexchange.com/  
  
  ---
  
  ### Answer by username_2 on 2023-08-01. Score: 1
  
  <https://www.open-scap.org/getting-started/>
  
  Use OpenSCAP to scan and remediate, it has CIS level 1 and 2 server profiles. I'm applying level 1 to my server, it's internal and level 1 leaves it quite usable. I tried applying the general server profile and it broke the server.
  
  
  ---
  
  