Is there a defacto understanding of what a golden image is? I've had it come up in requirements to satisfy cloud audits. What's the meaning of "Golden" when it comes to audit and compliance, especially for cloud services?
It seems like the word "Golden" has different meanings when it comes to different platforms, for instance you can mark a "Golden Snapshot" in UCS Director.
As noted in the comments there are several applications for the term. This answer focuses on the term as it relates to a compliance audit.
In the context of an audit, a golden image refers to an original image that is used when creating servers in your environment. Based on the reference below:
The term itself comes from the old practice of recordable CDs being manufactured with gold film. Hence the gold colored CD actually being the source
The NIST Risk Management Framework (800-53) refer to golden images as baseline configurations. In 800-53 CM-2:
Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.
An example that an auditor would be looking for is a hardened image of a specific OS version that is used to build out other servers in your environment. It demonstrates that your base-build a) has been reviewed, b) has not been altered, and that c) its use is repeatable.
References
What is the Genesis of the Term Golden Master
Golden Image
NIST 800-53 CM-2
