OpenBao (Hardened) on Amazon Linux 2023
This product has charges associated with it for image hardening, maintenance, and support. OpenBao secrets management on Amazon Linux 2023, security-hardened for production: minimal package set, SSH key-only access, IMDSv2-only, listener on loopback until you configure TLS, uninitialized at launch (your keys never leave you), and continuously patched images.
Why this image
- Security-hardened at build time: minimal packages, key-only SSH, IMDSv2-only, non-root service user with IPC_LOCK only, listener on loopback until TLS is configured.
- Ships uninitialized: no unseal keys, no root token, no state - run bao operator init yourself so key material never exists outside your control.
- Continuously patched: rebuilt, vulnerability-scanned, and republished on a regular cadence; Vault-compatible API under an open license (MPL-2.0).
About
OpenBao (Hardened) on Amazon Linux 2023 is a production-ready, security-hardened image of OpenBao, the Linux Foundation's open-source secrets-management server (API-compatible fork of HashiCorp Vault under an open license), maintained and supported by Derek Coleman & Associates Incorporated.
This is repackaged open-source software. OpenBao is a Linux Foundation project distributed under the Mozilla Public License 2.0. OpenBao is a trademark of The Linux Foundation; this listing is not endorsed by or affiliated with The Linux Foundation. This product builds OpenBao from unmodified upstream source with the current Go toolchain (so known standard-library vulnerabilities in prebuilt binaries are absent) on a hardened Amazon Linux 2023 base; the charges associated with this listing are for image hardening, continuous patching, vulnerability scanning, and business-day support - not for the underlying open-source software, which remains free.
Hardening baseline: minimal package footprint, SSH key-only access (password authentication disabled), IMDSv2 enforced, the server ships UNINITIALIZED (no unseal keys or root token exist until you run bao operator init, so your key material never touches our build), the listener binds to 127.0.0.1 until you configure TLS, and the process holds only the IPC_LOCK capability as a dedicated non-root user. Images are rebuilt, scanned for HIGH and CRITICAL vulnerabilities, and republished on a regular cadence so that new launches start current.
Pricing (hourly usage, AWS Marketplace)
| Instance type | Size | Software price |
|---|---|---|
| c7i.xlarge | 4 vCPU / 8 GiB | $0.46/hr |
| c7i.2xlarge | 8 vCPU / 16 GiB | $0.92/hr |
| c7i.4xlarge | 16 vCPU / 32 GiB | $1.84/hr |
Recommended: c7i.xlarge. AWS infrastructure charges are separate and billed by AWS. Charges stop when instances are terminated. No subscription, no minimum.
Getting started
Launch from AWS Marketplace (1-Click or EC2 console). Connect via SSH: ssh -i <key> ec2-user@<public-ip>. Initialize locally: export BAO_ADDR=http://127.0.0.1:8200 && bao operator init, then bao operator unseal. Store the unseal keys and root token securely - they exist only with you. To serve clients, configure a TLS listener in /etc/openbao/config.hcl, restart with: sudo systemctl restart openbao, and open port 8200 to trusted CIDRs only. Root login is disabled; use sudo. There are no passwords anywhere in this product.
Support
Email support@dcassociatesgroup.com — business-day response. Covers image operation, the hardening baseline, and launch issues. See support.