The best OS hardening is having less OS

Traditional OS hardening starts with a general-purpose Linux server and works through a benchmark such as CIS: disable unused services, tighten SSH, set file permissions, configure auditing, remove compilers. Hundreds of settings, applied and then defended against drift for the life of the server.

It works, but it’s subtractive. You start with everything and remove what you can. A different approach starts with almost nothing.

Amazon Linux 2 is a forcing function

Amazon Linux 2 reached end of support on June 30, 2026. Every fleet still running it needs to move, and moving is a chance to ask a bigger question than “which distribution next?” The question is: how much operating system does this workload actually need?

Three levels of less

1. A minimal general-purpose OS. Amazon Linux 2023 or another current distribution, installed with the smallest package set, built into an image by a pipeline, never changed by hand. Hardening settings are applied once at build time and verified by a scan before the image is promoted.

2. A container-optimized OS. For container hosts, purpose-built operating systems like Bottlerocket go much further. They include only what’s needed to run containers. There’s no package manager and no SSH by default. The root filesystem is read-only and integrity-checked at boot. Updates replace the whole OS image in one step and can be rolled back. Most of a CIS checklist doesn’t apply, because the things it hardens aren’t there.

3. No OS you manage at all. Fargate, Lambda and managed databases put the operating system on AWS’s side of the shared responsibility model. For many workloads, this is the strongest hardening there is.

Replace SSH with something auditable

The single biggest hardening change for most fleets is closing port 22. AWS Systems Manager Session Manager gives shell access without inbound ports or SSH keys. Access is controlled through IAM, and sessions can be logged to S3 or CloudWatch. Nobody needs a bastion host, and nobody needs to rotate a shared key when someone leaves.

What still matters

Less OS doesn’t mean no security work:

• Patch by replacing. Build new images frequently and roll them out. With immutable hosts, the image pipeline is the patching process.
• Least privilege for workloads. Instance and task roles with only the permissions each service needs. On a minimal OS, IAM is the boundary that matters most.
• Runtime visibility. Fewer tools on the host means you rely more on external detection, such as GuardDuty runtime monitoring, and on good logging.

Measure the attack surface, not the checklist

A hardening report that says “312 of 320 controls passed” describes effort. A more useful measure is how much there is to attack: open ports, installed packages, running services, people with shell access. Track those numbers per image. If they’re going down release after release, the fleet is getting harder to break into, whatever the checklist says.