CIS Level 1 EC2 Hardening Script
Bash script applying CIS Amazon Linux 2023 Level 1 benchmark. Every change documented with the corresponding CIS control reference. Safe to run on existing instances.
CIS Level 1 EC2 Hardening Script
A production-ready Bash script that applies every CIS Amazon Linux 2023 Level 1 benchmark control to a running EC2 instance. Each remediation is logged with its CIS section number so auditors can trace exactly what was changed and why.
Controls Covered
- Filesystem configuration — separate partitions, nodev/nosuid/noexec mount options, sticky bit on world-writable dirs (CIS 1.x)
- Software updates — ensures automatic security patching is configured (CIS 1.9)
- Network parameters — disables IP forwarding, redirects, source routing; enables TCP SYN cookies (CIS 3.x)
- Logging and auditing — auditd rules for privilege escalation, file deletion, sudoers changes (CIS 4.x)
- Access control — SSH hardening (no root login, max auth tries, ciphers), password policy, inactive account lockout (CIS 5.x)
Safety First
The script is idempotent and includes a --dry-run flag that prints every change without applying it. A full backup of modified config files is written to /var/lib/cis-backup/ before any change is made, and a rollback script is generated automatically.
What You Get
harden.sh— main hardening script with inline CIS referencesaudit.sh— post-run compliance check that prints a pass/fail reportrollback.sh— restores all backed-up filesREADME.md— usage, exclusion list, integration with AWS Systems Manager
Service URLs & Requirements
Amazon Linux 2023. Also works on Amazon Linux 2 (EOL June 2026 — migrate when you can). Run as root or via sudo. Can be delivered via EC2 User Data or SSM Run Command for fleet-wide deployment.