Solve: Patch the STIG Mapping Mismatch in EC2 Image Builder for Amazon Linux 2023

Solve: Patch the STIG Mapping Mismatch in EC2 Image Builder for Amazon Linux 2023

Note from the Field

If you're using EC2 Image Builder to STIG-harden Amazon Linux 2023, heads up—you're likely mapped against the wrong OS baseline. AL2023 is being treated like RHEL8, but it aligns more closely with RHEL9 or Fedora. That misalignment causes real issues: SELinux isn’t installed, some packages are missed, and the hardening script quietly skips critical steps. This isn’t a beginner’s problem—it’s one of those senior DevOps calls where you either override the mapping or rebuild the compliance path yourself. Here’s how to fix it.



Problem

Amazon Linux 2023 (AL2023) is being STIG-hardened via EC2 Image Builder components that assume a RHEL8 baseline. This causes SELinux to be skipped and key security steps to fail silently. The result? Hardened-in-name-only images that fall short of compliance and security goals.



Clarifying the Issue

AL2023 is a modern, Fedora-based distribution that aligns much closer to RHEL9 than RHEL8. However, AWS’s default STIG hardening logic applies outdated assumptions: it uses RHEL8 package expectations, yum logic, and policies that don’t cleanly map to the DNF-driven structure of AL2023. This leads to incorrect or incomplete enforcement—especially around SELinux configuration.

For engineers relying on automation, the danger lies in the silence. The Image Builder pipeline doesn’t throw errors, and the build appears “successful.” But if you check the logs, SELinux isn't even installed—and that means one of the most fundamental security controls is absent.


Why It Matters

Security automation isn’t just about box-checking—it’s about true system integrity. If your images report as hardened but skip SELinux or silently fail to apply policy, you’re left with an attack surface wider than it looks. In regulated environments, this creates compliance gaps. In production environments, it creates risk. Senior engineers need a way to correct the baseline or override AWS's flawed assumptions before systems go live.


Key Terms

• STIG (Security Technical Implementation Guide): A standardized set of security configurations.
• EC2 Image Builder: AWS’s tool for automated AMI creation with optional hardening steps.
• AL2023 (Amazon Linux 2023): A Fedora-aligned distro with dnf and newer security policies.
• SELinux: A kernel-level access control system critical to many STIG profiles.
• Component (Image Builder): A YAML-defined set of build steps for hardening or customization.

Steps at a Glance

1. Create a custom Image Builder component for AL2023.
2. Manually install and configure SELinux using DNF.
3. Override the default STIG component in your Image Builder pipeline.
4. Verify SELinux status and confirm policy enforcement in the build logs.

Detailed Steps

Step 1: Write the Custom Component

Here’s a fully functional YAML component you can drop into EC2 Image Builder. It installs SELinux using DNF, enables enforcement, and modifies the config file so the change survives reboot. 

yaml

name: FixSELinuxForAL2023
description: "Manually install and enforce SELinux in Amazon Linux 2023 to patch STIG hardening gaps"
schemaVersion: 1.0
phases:
  - name: build
    steps:
      - name: install-selinux
        action: ExecuteBash
        inputs:
          commands:
            - sudo dnf install -y selinux-policy selinux-policy-targeted setools-console
            - sudo setenforce 1
            - sudo sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
            - echo "SELinux installed and set to enforcing mode."

Step 2: Register the Component via CLI

Save the above as fix-selinux-al2023.yml, then register it: 

Adjust the region and versioning as needed.

bash

aws imagebuilder create-component \
  --name FixSELinuxForAL2023 \
  --semantic-version 1.0.0 \
  --platform Linux \
  --data file://fix-selinux-al2023.yml \
  --region us-east-1

Step 3: Add to Your Image Builder Pipeline

Insert the new component into your pipeline before any STIG validations. Example: 

json

{
  "components": [
    {
      "componentArn": "arn:aws:imagebuilder:us-east-1:123456789012:component/fixselinuxforal2023/1.0.0"
    },
    {
      "componentArn": "arn:aws:imagebuilder:us-east-1:aws:imagebuilder:standard:1.0.0"
    }
  ]
}

Use CloudFormation or the console if you prefer GUI-based updates.

Step 4: Run the Pipeline and Validate Output

After the build completes, check the logs or run the following commands manually to confirm enforcement: 

bash

getenforce
# Should return: Enforcing

rpm -q selinux-policy selinux-policy-targeted
# Should return installed package versions

Grab the Companion Gist

To make this even easier to implement, we’ve published a companion GitHub Gist containing everything you need:

• The full YAML component (fix-selinux-al2023.yml)
• A CLI command to register it with Image Builder
• A clean, well-documented README for quick reuse

This is a fast way to drop the fix into your pipeline or share it across your team without copying from the blog post. Feel free to fork, adapt, and improve as needed.

Conclusion

This isn’t a documentation miss—it’s a structural mismatch. AWS is still treating Amazon Linux 2023 like an older generation OS. But the fix is simple once you recognize it: realign the hardening logic, install SELinux manually, and regain control over your compliance posture. Until AWS updates the STIG baseline or reclassifies AL2023, this component keeps your pipeline secure and audit-ready.

* * * 

Written by Aaron Rose, software engineer and technology writer at Tech-Reader.blog.