Image Builder Component to enable FIPS on Amazon Linux 2023

[mvhowardAWS]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Tell us about your request Please create an Image Builder component that enables FIPS mode on Amazon Linux 2023. Instructions for doing this on Amazon Linux 2 are available here: https://aws.amazon.com/blogs/publicsector/enabling-fips-mode-amazon-linux-2/. Amazon Linux 2023 instructions are unavailable yet.

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard? Configuring FIPS mode on Amazon Linux requires additional steps as outlined in the link above. Having Image Builder be able to do this on the image without having to create a custom script would be beneficial.

Are you currently working around this issue? Using custom scripting to enable FIPS mode currently.

[reelieuglie]

For anyone following this, I have an image builder component for enabling FIPS in AL2023. Normal copy-at-your-own-peril suggestions apply, and please take this as an example to build your own; not to copy and paste into some production environment somewhere:

name: Enable FIPS
description: This is a document to enable FIPS in Amazon Linux 2023
schemaVersion: 1.0

phases:
  - name: build
    steps:
      - name: Enable_Fips
        action: ExecuteBash
        inputs:
          commands:
            - sudo dnf -y install crypto-policies crypto-policies-scripts
            - sudo fips-mode-setup --enable
      - name: Reboot
        action: Reboot

  - name: test
    steps:
      - name: Verify_FIPS
        action: ExecuteBash
        inputs:
          commands:
            - sudo fips-mode-setup --check