View a markdown version of this page

Security updates and features - Amazon Linux 2027
SELinux enforcing by defaultPost-Quantum Cryptography (PQC) by DefaultSSH server defaultManage updatesSecurity in the cloud

Security updates and features

AL2027 Preview

AL2027 is currently available for preview. It is intended for evaluation and testing only and is not recommended for production workloads.

AL2027 includes several security enhancements over AL2023

SELinux enforcing by default

The SELinux mandatory access control policies define permissions for users, processes, programs, files, and devices.

By default, SELinux is enabled and set to enforcing mode in AL2027. This means that SELinux security policy is fully enforced, in contrast with permissive mode (default in AL2023) where permission denials are logged but not enforced.

For more information about SELinux modes and policy, see Setting SELinux modes for AL2027 and the SELinux Project.

Post-Quantum Cryptography (PQC) by Default

The system-wide cryptographic policies on AL2027 now enables post-quantum cryptography (PQC) by default.

  • OpenSSH enables Post-Quantum Cryptography (PQC) key exchange by default.

  • OpenSSL 3.5 added support for the ML-KEM hybrid key exchange algorithm, and ML-DSA (ML-DSA-44, ML-DSA-65, and ML-DSA-87) and SLH-DSA signature algorithms.

  • GnuTLS 3.8.10 supports ML-KEM hybrid key exchange algorithms and ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms for TLS communications.

  • NSS 3.124 supports the ML-KEM hybrid key exchange algorithm and ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms for TLS communications.

For more information about Post-Quantum Cryptography on AWS, see: AWS Cloud Security > Post-Quantum Cryptography

SSH server default

AL2027 includes OpenSSH 9.9p1.

  • Post-Quantum Cryptography (PQC) key exchange is enabled by default

  • Additional default configurations have been added to /etc/ssh/sshd_config.d/10-amazon-hardening.conf

  • DSA signature algorithm support is no longer available. If you have existing DSA host keys or client keys, you must migrate to a supported key type (RSA, ECDSA, or Ed25519) before upgrading to AL2027.

  • RSA keys <2048 bits are not allowed by default

For more information, see Default SSH server configuration.

Manage updates

Apply security updates using DNF and repository versions. For more information, see Manage package and operating system updates in AL2027.

Security in the cloud

Security is a shared responsibility between AWS and you. The shared responsibility model describes this as security of the cloud and security in the cloud. For more information, see Security and Compliance in AL2027.