Security by design.
Our approach to building, validating, and maintaining production-ready cloud images.
Scope of these practices
These practices apply to the NebulaImage AMI build and publication process. Once you launch an instance, you are responsible for the security of your EC2 environment, including security groups, network configuration, application security, and ongoing patch management.
Security Practices
CVE Awareness
We monitor published CVEs relevant to packages included in NebulaImage releases. When significant vulnerabilities are disclosed, we assess their impact and publish updated AMI versions as appropriate.
Security Updates at Build Time
All available OS and package security updates are applied when an image is built. A freshly launched instance starts from a current, patched state.
Minimal Installed Surface
Each image includes only the packages required to fulfill its intended purpose. A smaller installed footprint means fewer potential attack vectors.
No Hardcoded Credentials
NebulaImage AMIs do not contain hardcoded passwords, API keys, database credentials, or secret material.
No Pre-embedded SSH Keys
No SSH authorized keys are embedded in published images. Access is controlled through the EC2 key pair specified at launch.
Automated Validation
Each image build goes through automated checks before publication, including service startup, software version, and configuration checks.
Versioned Releases
Every published AMI is tagged with a version identifier and release notes describe what changed between versions.
Image Build Process
NebulaImage AMIs are built from a clean Ubuntu base using a reproducible, automated build process. The general pipeline is:
- 1
Base image
Start from the official Canonical Ubuntu AMI for the target LTS release.
- 2
System update
Run apt update && apt upgrade -y to apply all available security patches.
- 3
Package install
Install only the packages required for this product. No extras.
- 4
Configuration
Apply service configuration, firewall rules, and cloud-init settings.
- 5
Credential check
Verify no credentials, keys, or secrets are present in the image.
- 6
Validation
Automated tests confirm services start and expected versions are present.
- 7
Snapshot & publish
Create a versioned AMI snapshot and publish to AWS Marketplace.
Release Lifecycle
New image versions are published when significant security updates are available, or when software versions warrant a refresh. Version identifiers allow you to track what changed between releases.
Running instances are not automatically updated. To adopt a new AMI version, you would launch a new instance from the updated AMI and migrate your workload. We document the changes in each release so you can evaluate whether an update is relevant to your environment.
Reporting a Security Issue
If you discover a security issue in a NebulaImage product, please contact us at [email protected]. Please provide a description of the issue and steps to reproduce it. We will respond promptly and keep you informed of our progress.
Please do not report security issues through public GitHub issues or public forums.