# Golden image

> A pre-built, pre-hardened VM image that serves as the standard base for every server an organization deploys.

A **golden image** is a virtual machine image that has been built once, configured and hardened to an organization's standard, and then used as the base for every server deployed from it. Instead of provisioning a stock operating system and then applying configuration, patches, and hardening to each running instance, you bake all of that into the image and deploy the result.

The appeal is consistency. Every instance launched from a golden image starts in a known state: the same packages, the same versions, the same hardening, the same agents. Configuration drift between servers largely disappears, because there is nothing left to drift — the differences that used to accumulate across a fleet were mostly the result of applying changes to each machine individually.

The cost is that somebody has to build and maintain the image. A golden image is only as good as its most recent rebuild: it ages the moment a new CVE is published against something inside it, which is why golden images are rebuilt on a schedule and on upstream changes, rather than being built once and forgotten.

Golden images are commonly built with tools like Packer and a configuration-management system such as Ansible, then published as an [AMI](https://primcoat.app/glossary/ami) on AWS, a Compute Gallery image on Azure, or the equivalent on other platforms.

## Related

- https://primcoat.app/glossary/immutable-infrastructure.md
- https://primcoat.app/glossary/cis-benchmark.md
- https://primcoat.app/glossary/sbom.md

---

Source: https://primcoat.app/glossary/golden-image
Primcoat — a managed VM image factory. https://primcoat.app