Good, but still lacks some stuff
I have been using this AMI in PCI DSS env for quite some time, however out of the box it doesn't pass Amazon Inspector findings - still needs quite a bit of tuning to deal with findings. Things like sshd protocol version is not set, sshd logging, password lockout policy, etc.
I was not able to find CHANGELOG - basically its some "black box".
Thank you for your feedback! We would love to hear more from you on this product. Please visit https://www.cisecurity.org/support and submit a support ticket under “CIS Product Technical Support” to provide additional feedback or engage with CIS support. Thank you!