# Ensure only verified packages are installed

- Source: https://support.icompaas.com/support/solutions/articles/62000234386-ensure-only-verified-packages-are-installed
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Docker Benchmark v1.7.0](https://support.icompaas.com/support/solutions/62000112687) › [CIS Docker Benchmark](https://support.icompaas.com/support/solutions/folders/62000169241)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-   Level 2  
    

Description:

Verify the authenticity of packages before installing them into images.  

Rationale:

Installing packages without verification can lead to vulnerabilities and risks if the packages are not from trusted sources.  

Impact:

-   Ensures the installed packages are secure and trustworthy.
    
-   Requires additional steps to verify the authenticity of each package.  
    

Default Value:

Not applicable.  

Pre-requisites:

Ensure secure package management tools are used (e.g., GPG keys for RPM-based systems).  

Remediation:

Test Plan:

Using AWS Console:

1.  Check the Dockerfile to ensure GPG keys or another secure method are used to verify package authenticity.  
    
2.  Run docker history <IMAGE ID> for each image to verify how package authenticity is determined.

Using AWS CLI:

1.  Use SSM to check the package installation methods:  
    

aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["docker history <IMAGE\_ID>"\]'

Implementation Plan:

Using AWS Console:

1.  Modify the Dockerfile to use secure package management tools.  
    
2.  Rebuild the Docker image:  
    

docker build -t <IMAGE\_NAME> .

Using AWS CLI:

1.  Use SSM to update the Dockerfile and rebuild the image:  
    

aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["sed -i \\"s/apt-get install/apt-get install --verify-key <GPG\_KEY>/g\\" Dockerfile && docker build -t <IMAGE\_NAME> ."\]'

Backout Plan:

Using AWS Console:

1.  Revert the Dockerfile changes to allow non-secure package installs.  
    
2.  Rebuild the Docker image:
    
    docker build -t <IMAGE\_NAME> .
    

Using AWS CLI:

1.  Use SSM to revert the changes:  
    
    aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["sed -i \\"s/--verify-key <GPG\_KEY>//g\\" Dockerfile && docker build -t <IMAGE\_NAME> ."\]'
    
      
    

References:

-   CIS Docker Benchmark v1.7  
    
-   RedHat GPG Verify: [https://www.redhat.com/sysadmin/rpm-gpg-verify-packages](https://www.redhat.com/sysadmin/rpm-gpg-verify-packages)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.