AWS Builder Center: Learn, Build and Connect with builders in the AWS community

AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.

How do I make sure that my Amazon EC2 Linux instance has the latest patches and security updates?

9 minute read

I want to make sure that my Amazon Elastic Compute Cloud (Amazon EC2) Linux instances are updated and secure.

Resolution

Important: Amazon Linux 2 (AL2) will reach its end of life on June 30, 2026. After end of support, AL2 won't receive security updates or produce new patches. If you run AL2, then migrate to Amazon Linux 2023 (AL2023) before the end-of-support date. Test migrated applications in a non-production environment first. AL2023 uses versioned repositories.

By default, each AL2023 Amazon Machine Image (AMI) is locked to a specific repository version. AL2 uses the yum command and AL2023 uses the dnf command. In dnf, update is an alias for upgrade.

Check for available patches

To check for available package updates that include security patches and bug fixes, run the following command:

sudo dnf check-update

Note: For AL2, replace dnf with yum.

In the command's output, review the list for security-related updates or updates for critical system packages, such as kernel, OpenSSL, or other core libraries.

Important: It's a best practice to apply all updates available in a new AL2023 release. Don't select only security updates or specific updates.

To view your current release version for AL2023, run the following command:

sudo dnf list installed | grep system-release

To view all available release versions, run the following command:

sudo dnf --showduplicates list system-release --releasever=latest

To check for available updates with the latest release version, run the following command:

sudo dnf --releasever=latest check-update

Note: To check for available updates for a specific release version, replace latest with the release version.

It's a best practice to test the upgraded version on non-production environments first. Don't upgrade to the latest release version on a production environment until you test the version.

To upgrade to the latest release version, run the following command:

sudo dnf upgrade --releasever=latest

Note: To upgrade to a specific release version, replace latest with the release version.

Check for security updates

Identify missing security updates

To list all available security updates from a specific release version, run the following command:

sudo dnf updateinfo list --security --releasever=release_version_number

Note: Replace release_version_number with the release version that you want for security updates. For AL2, replace dnf with yum and remove --releasever=release_version_number. AL2 uses a rolling update process, so the command lists all available security updates. To view currently installed security updates for AL2, add installed.

Run the following command to list all available security updates from the latest release version:

sudo dnf updateinfo list --security --releasever=latest

Apply security updates

To install only the security updates from a specific release version, run the following command:

sudo dnf upgrade --security --releasever=release_version_number

Note: Replace release_version_number with the release version that you want to use for security updates.

To install only the security updates from the latest release version, run the following command:

sudo dnf upgrade --security --releasever=latest

To apply security updates in AL2, run the following command:

sudo yum update --security

Apply updates only for the packages that a specific advisory mentions

Run the following command:

sudo dnf upgrade-minimal --advisory=ALAS2023-2025-XXXX --releasever=release_version_number

Note: Replace ALAS2023-2025-XXXX with the advisory ID and release_version_number with the release version. To apply the latest available version, replace upgrade-minimal-advisory with upgrade-advisory and release_version_number with latest.

Automate patches to your instances

To apply critical security patches to the Linux kernel without reboots or downtime, activate Kernel Live Patching. For instructions, see Apply kernel live patches.

You can also use Kernel Live Patching on your AL2 instances. However, Amazon Linux no longer provides live patches for AL2 4.14 and will support live patches to AL2 only until June 30, 2026. For more information, see Kernel Live Patching on AL2.

To automate patches at scale, use Patch Manager, a capability of AWS Systems Manager.

Determine whether you must reboot the instance after updates

Some updates, such as kernel and core library updates, require an instance reboot to take effect.

To check whether your instance requires a reboot, run the following command:

sudo dnf install dnf-utils
sudo needs-restarting -r

Note: For AL2, replace dnf with yum and dnf-utils with yum-utils.

In the output, an exit code of 0 means that a reboot isn't required. If the exit code is 1, then you must reboot your instance to apply the updates. Kernel updates require a system reboot unless you use Kernel Live Patching.

To identify services that you must restart even if you don't reboot the system, run the following command:

sudo needs-restarting -s

To apply your changes, restart the services that appear in the command output.

Exclude packages from updates

You might need to exclude a specific package from an update to maintain compatibility or prevent unintended changes.

To temporarily exclude the package, run the following command:

sudo dnf upgrade --exclude=kernel* --releasever=latest

Note: For AL2, replace dnf with yum and --releasever=latest with --exclude=package-name*. Also, replace package-name with the package name.

To permanently exclude packages, add an exclude directive to the configuration file. Update /etc/dnf/dnf.conf with the following line:

[main]
exclude=kernel* package-name*

Note: Replace package-name with the package name. For AL2, update /etc/yum.conf.

To prevent changes to specific packages, run the following commands to lock the package version:

sudo dnf install python3-dnf-plugin-versionlock
sudo dnf versionlock add package-name-version
sudo dnf versionlock list

Note: Replace package-name-version with the package name and its version. For AL2, replace dnf with yum, python3-dnf-plugin-versionlock with yum-plugin-versionlock, and package-name-version with the package name followed by an asterisk (*).

To remove a version lock, run the following command:

sudo dnf versionlock delete package-name-version

Note: Replace package-name-version with the package name and its version. For AL2, replace dnf with yum and package-name-version with the package name followed by an asterisk (*).

Roll back updates

Important: You can't roll back a running kernel that's in use.

If an update causes issues, then complete the following steps to roll back to a previous package version:

Run the following command to reboot into the previous kernel:

grubby --set-default /boot/vmlinuz-previous-kernel-version

Note: Replace previous-kernel-version with the previous kernel version.

Run the following command to reboot the system:
```
sudo reboot
```
Run the following command to view the transaction history for your instance:
```
sudo dnf history list
```
Note: For AL2, replace dnf with yum.
To view the details of a specific transaction, run the following command:
```
sudo dnf history info transaction_id
```
Note: Replace transaction_id with the transaction ID. For AL2, replace dnf with yum.
To undo a specific transaction, run the following command:
```
sudo dnf history undo transaction_id
```
Note: Replace transaction_id with the transaction ID. For AL2, replace dnf with yum.
To roll back to a state before a transaction, run the following command:
```
sudo dnf history rollback transaction_id
```
Note: Replace transaction_id with the transaction ID. The preceding command undoes all transactions that occurred after that transaction. For AL2, you can roll back only a single transaction.

To downgrade a specific package to a previous version, run the following command:

sudo dnf downgrade package-name-version

Note: Replace package-name-version with the package name and version that you want to roll back to. For AL2, replace dnf with yum.

Configure automatic security updates

First, run the following command to install the scheduler:

sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic-install.timer

Note: For AL2, replace dnf with yum, dnf-automatic with yum-cron, and dnf-automatic-install.timer with yum-cron.

Then, upgrade the scheduler file to configure the scheduler behavior. Edit /etc/dnf/automatic.conf with the following values:

[commands]
upgrade_type = security
apply_updates = yes

Note: For AL2, edit /etc/yum/yum-cron.conf and replace upgrade_type with update_cmd.

Important: On AL2023, dnf-automatic can access updates only if they're available in the current locked repository version. To automatically receive new updates, it's a best practice to use Patch Manager. For non-production environments, you can also set releasever = latest in /etc/dnf/dnf.conf or periodically update the releasever to a tested version.

Find and patch Linux instances based on a security advisory

Complete the following steps:

Open the Amazon Linux Security Center, and then choose Explore CVEs.
Check whether the Amazon Linux version that you use is affected.
Choose the advisory for the AWS resource or service. The advisory contains detailed information about the common vulnerability and exposure (CVE), affected packages, resolution, and list of the new packages and their package versions. Note the advisory ID.
To check whether the patch is already installed, run the following command:
```
sudo dnf updateinfo list --security installed --releasever=latest | grep 'advisory-ID
```
Note: Replace the advisory-ID with the advisory ID. If the output shows the Security Advisory entry, then the patch for that vulnerability is installed. For AL2, replace dnf with yum and remove -releasever=latest.

If your patches address a CVE, but the scanner still reports unpatched CVEs, then see How do I resolve security vulnerabilities in Amazon Linux packages that remain unpatched after I applied the patches?

Activate SPAL to access existing EPEL packages

To get access to packages from Extra Packages for Enterprise Linux 9 (EPEL9) for your AL2023 instances, use the Supplementary Packages for Amazon Linux (SPAL). For installation instructions, see Tutorial: Configure SPAL repository on AL2023.