Frozen package management for air-gapped RHEL-family AMIs

This article describes a two-account AWS pattern for managing frozen package repositories in air-gapped RHEL-family compute fleets with approval-gated updates.

• Separates connected package ingestion in a Distribution account from air-gapped Workload instances using S3 and cross-account IAM policies
• Stores versioned, approved package snapshots in S3 with KMS encryption and manifest tracking for audit compliance
• Uses EC2 Image Builder to build AMIs from frozen repositories with no public package sources configured
• Implements scheduled detection, human approval workflow, and selective sync of package changes via Lambda and Fargate
• Deploys internal HTTPS mirror using Nginx and aws-sigv4-proxy for read-only cross-account S3 access
• Patch Manager uses the same frozen repository for consistent patching across image builds and running instances
• Provides CloudTrail audit trails and DynamoDB records for SOC 2, ISO 27001, and FDA compliance evidence
• Reference implementation includes Terraform modules, Lambda handlers, and AlmaLinux example with optional genuine RHEL support

The pattern enables regulated organizations to maintain strict package control, explicit approval workflows, and complete audit trails while keeping air-gapped fleets updated from a single frozen repository source.