Golden image

A golden image is a virtual machine image that has been built once, configured and hardened to an organization’s standard, and then used as the base for every server deployed from it. Instead of provisioning a stock operating system and then applying configuration, patches, and hardening to each running instance, you bake all of that into the image and deploy the result.

The appeal is consistency. Every instance launched from a golden image starts in a known state: the same packages, the same versions, the same hardening, the same agents. Configuration drift between servers largely disappears, because there is nothing left to drift — the differences that used to accumulate across a fleet were mostly the result of applying changes to each machine individually.

The cost is that somebody has to build and maintain the image. A golden image is only as good as its most recent rebuild: it ages the moment a new CVE is published against something inside it, which is why golden images are rebuilt on a schedule and on upstream changes, rather than being built once and forgotten.

Golden images are commonly built with tools like Packer and a configuration-management system such as Ansible, then published as an AMI on AWS, a Compute Gallery image on Azure, or the equivalent on other platforms.