Amazon Linux 2023 FAQs

Major releases will include new features security and performance improvements across the stack, including the kernel, toolchain, glibc, openssl and all other system libraries and utilities. Major releases of AL2023 will be based in part on the current version of the upstream Fedora Linux distribution, though Amazon may choose to add or replace specific packages from other non-Fedora upstreams (e.g. Linux kernel is sourced from kernel.org’s Long Term Support choices and is maintained specifically for Amazon’s Linux products). You should expect major release updates for packages in the repository that are sometimes not backwards compatible. We will provide a full list of changes between major releases and you will be able to perform in-place upgrade on a package level.

Quarterly minor releases (1.1, 1.2) will include security updates, bug fixes, and new features and packages. Examples of minor releases include latest language runtimes, like PHP and other popular software packages such as Ansible and Docker. Minor releases do not bring changes that break application compatibility. For example, the default versions of language runtimes will stay stable while the newer version of language runtimes are provided into the repository as new packages.

Updates are provided via a combination of new AMI (Amazon Machine Image) releases and corresponding new repositories. By default, a new AMI and the repository to which it points are coupled, but you can point your running Amazon EC2 instances to newer repository versions over time in order to consume updates on running instances. You can also update by launching new instances of the latest AMIs.

When we publish a new version of the AL2023 repositories, all previous versions will still be available. By default, the plugin for managing repository versions will lock to the same version that was used to build the AMI. If you need to control package updates, you can discover available repository versions to update to by running “dnf check-release-update”, and select a version by running the listed command, “dnf —releasever=version update”. At that point, “dnf install” or “dnf upgrade“ will only choose packages from the selected repository version. If you do not need to control package updates, you can select the “latest” version, which will always point to the most recent version of the AL2023 repositories. This restores the legacy behavior for package updates that you and existing patch workflows might expect.

AL2023 locks to a specific version of your repository. The AL2023 AMI shown in the EC2 launch wizard will always be the latest and have the most up to date packages and updates, including critical and important security updates. If you launch an EC2 instance using the AL2023 AMI via the launch wizard, you will always have the latest updates (same as the current experience with AL2). However, if you launch an instance from an older AMI, no updates will automatically be applied and any additional packages that are installed as part of your provisioning will map to the repository version from which the older AMI was built. This enables you to ensure there is consistency of package versions and updates across your environment, especially if you are launching multiple instances from the same AMI. You can apply updates based on the schedule that works for you.

Yes. SELinux is a security module providing access control policies. It is widely used in the industry to lock down Linux servers and to protect against malicious activity. Major applications within AL2023 come with pre-configured SELinux policies to help you meet your compliance needs.

AL2023 will have SELinux in permissive mode by default. You can change SELinux settings to enforced mode via command line by executing ‘setenforce’ or by running this command on launch from cloud-init userdata. When the instance is rebooted, it will remember and use the SELinux setting that was specified the first time unless you change it. Please refer to the AL2023 documentation for more details.

Please see the Amazon Linux 2023 Release Notes for full details. Examples of changes coming between Release Candidate and GA include the Hibernation Agent, and AMIs being registered to launch with IMDSv2 only (i.e. disabling IMDSv1) by default.

Amazon Linux, like most Linux distributions, routinely backports security fixes to stable package versions vended in its repositories. When these packages are updated with a backport, the Amazon Linux security bulletin for the particular issue will list the specific package version(s) in which the issue is fixed for Amazon Linux. Security scanners that rely on versioning from a project’s authors sometimes won’t pick up that a given CVE fix has been applied in an older version. Customers can refer to Amazon Linux Security Center (ALAS) for updates regarding security issues and fixes.

The Federal Information Processing Standard (FIPS) Publication 140-3, contains standards and guidelines for data protection and encryption for federal computer systems. It was developed by the National Institute of Standards and Technology (NIST), Canadian Centre for Cyber Security (CCCS), and industry working groups to validate the effectiveness of cryptographic modules. FIPS 140-3 aligns with the ISO/IEC 19790 standard and introduces new enhancements to the security requirements relative to the now retired FIPS 140-2 standard. If your organization is a federal agency in the United States, Canada, or works with federal agencies with handling sensitive data, FIPS 140-3 may be required.

To enable FIPS mode on AL2023, download the required packages on your Amazon EC2 instance and connect to it to turn on FIPS mode. For detailed instructions, see our Enable FIPS Mode.

Amazon Linux 2023 cryptographic modules have been submitted for FIPS 140-3 validation. The Amazon Linux 2023 Kernel Crypto API Cryptographic Module has now been FIPS validated (certificate #4808). The remaining 4 cryptographic (OpenSSL, NSS, Libgcrypt, GnuTLS) modules are on the FIPS Module in Process (MIP) list. The MIP list contains cryptographic modules that have completed all FIPS testing and are awaiting Cryptographic Module Validation Program (CMVP) review and issuance of the certificate. The CMVP is a joint effort between the National Institute of Standards and Technology under the Department of Commerce and the Canadian Centre for Cyber Security, a branch of the Communications Security Establishment. Please visit the MIP list linked above to see the status of in-process reviews or the CMVP modules search page for all completed AL2 and 2023 cryptographic modules.

Customers may be able to use AL2023 cryptographic modules while the modules are in MIP list. AWS recommends that customers consult their compliance team to ascertain if using AL2023 cryptographic modules for their FIPS-required workloads is acceptable and to obtain approvals when required. 

AL2023 OpenSSL, NSS, Libgcrypt, Kernel and GnuTLS were tested on Intel, AMD and Graviton. The details will be listed on the FIPS Security Policies for each validation as they complete.

AL2023 provides updates for its packages and will maintain compatibility within a major version for customer applications built on AL2023. Core packages, such as glibc, openssl, openssh, and the dnf package manager, receive support for the lifetime of the major AL2023 release. Packages that are not part of the core packages will receive support defined by their upstream sources. You can view the specific support status and dates of individual packages by running the ‘dnf supportinfo packagename’ command. The full list of core packages will be finalized during preview. If you would like to see more packages included as core packages, please tell us, and we will evaluate as we are collecting feedback. Feedback on Amazon Linux 2023 can be provided through your designated AWS representative, Amazon Linux Discussion Forum or Amazon Linux 2023 GitHub page.