Skip to main content

Quickstart Guide

This guide walks you through building your first hardened golden image with ImageFactory. By the end, you will have a CIS-hardened Ubuntu AMI distributed to your AWS account.

Time required: ~15 minutes (plus ~20 minutes for the image build to complete)

Prerequisites​

Before you begin, make sure you have:

  • Access to the ImageFactory UI at imagefactory.nordcloudapp.com
  • A customer account provisioned by your Nordcloud contact
  • An AWS account where you want the image distributed
  • An IAM role in that AWS account that ImageFactory can assume (see AWS Onboarding for full details)

Step 1: Log In and Select Your Customer​

  1. Navigate to imagefactory.nordcloudapp.com
  2. Authenticate with your organization credentials through the single sign-on flow
  3. If you have access to multiple customers, select the one you want to work with

Step 2: Onboard Your AWS Account​

Navigate to Cloud Credentials in the left sidebar, then click Add Account.

Fill in the account details:

FieldValue
ProviderAWS
Cloud Provider IDYour 12-digit AWS account ID
AliasA friendly name (e.g., production-us-east)
ScopePUBLIC
IAM Role ARNarn:aws:iam::<ACCOUNT_ID>:role/ImageFactoryMasterRole
External IDThe external ID provided during role setup

Click Save. ImageFactory validates the credentials immediately. Wait for the status to show ACCESS_SUCCESS before proceeding.

Using the API instead?
mutation {
  createAccount(
    customerId: "your-customer-id"
    input: {
      provider: AWS
      cloudProviderId: "123456789012"
      alias: "production-us-east"
      scope: PUBLIC
      credentials: {
        roleArn: "arn:aws:iam::123456789012:role/ImageFactoryMasterRole"
        externalId: "your-external-id"
      }
    }
  ) {
    id
    state { status }
  }
}

Step 3: Create an Image Template​

Navigate to Image Templates and click Create Template.

3a. Select Provider and Distribution​

  1. Choose AWS as the provider
  2. From the distribution list, select Ubuntu 22.04 (or any supported distribution)

3b. Add Build Components​

Select the components to install during the image build:

  • Hardening Level 1 (recommended): applies CIS Level 1 benchmark hardening
  • AWS CloudWatch Agent (optional): installs the CloudWatch monitoring agent

Leave component versions set to latest unless you need to pin a specific version.

3c. Configure AWS Settings​

SettingValue
Regioneu-west-1 (or your preferred region)
EBS Volume Typegp3 (recommended)

3d. Set Tags (optional)​

Add tags that will be applied to the resulting AMI:

KeyValue
Environmentproduction
ManagedByImageFactory

3e. Select Target Accounts​

Check the box next to the AWS account you onboarded in Step 2. The built image will be distributed to all selected accounts.

3f. Save and Build​

Click Create. ImageFactory validates the configuration and automatically triggers the first build.

Using the API instead?
mutation {
  createTemplate(
    customerId: "your-customer-id"
    input: {
      name: "Ubuntu 22.04 Hardened"
      provider: AWS
      distributionId: "dist-ubuntu-2204-aws"
      config: {
        scope: PUBLIC
        cloudAccountIds: ["your-account-id"]
        aws: {
          region: "eu-west-1"
          ebsVolumeType: gp3
        }
        buildComponents: [
          { id: "hardening-level-1-id", version: "latest" }
          { id: "cloudwatch-agent-id", version: "latest" }
        ]
        tags: [
          { key: "Environment", value: "production" }
          { key: "ManagedBy", value: "ImageFactory" }
        ]
      }
    }
  ) {
    id
    name
    state { status }
  }
}

Step 4: Monitor the Build​

After creation, the template moves through the following states:

Click on your template in the list to view real-time status. A typical build takes 15-25 minutes depending on the distribution and number of components.

The IMAGE_BUILDING phase provisions a temporary instance, applies system preparation, runs hardening scripts, installs your selected components, and captures the final image. The IMAGE_TESTING phase runs any test components and performs the CIS compliance scan.

Step 5: Review the Results​

Once the status reaches IMAGE_CREATED, click the image in the build history to see:

SectionWhat It Shows
Compliance ScorePercentage of CIS benchmark checks that passed (Level 1 and Level 2)
Compliance ReportDownload the full PDF or JSON report with per-rule pass/fail details
Package InventoryComplete list of all packages installed in the image
Distribution ResultsThe AMI ID created in each target account
Build DurationTotal build time in seconds
Change LogDifferences from the previous build (empty for first build)

Copy the AMI ID from the distribution results to use when launching EC2 instances.

Step 6: Launch an Instance from Your Image​

In the AWS Console (or via CLI), launch an EC2 instance using the AMI ID from the distribution results:

aws ec2 run-instances \
  --image-id ami-0abc123def456 \
  --instance-type t3.medium \
  --key-name my-key-pair \
  --region eu-west-1

Your instance now runs on a CIS-hardened, patched, and validated golden image.

What Happens Next​

ImageFactory continues working after the initial build:

  • Automatic rebuilds: When the source Ubuntu 22.04 AMI is updated by Canonical, ImageFactory detects the change and triggers a new build automatically
  • Security checks: Periodic scans identify if a rebuild is needed due to new vulnerabilities
  • Weekly updates: Scheduled rebuilds ensure OS packages stay current
  • Notifications: Configure SNS, Pub/Sub, or webhook notifications to alert your team when new images are ready (see Notifications)

You can disable automatic rebuilds per template by setting disableCyclicalRebuilds: true in the template configuration.

Next Steps​

Now that you have your first image building, explore these areas: