Amazon Linux 2 End of Life: June 30, 2026 — What Breaks and How to Migrate
Amazon Linux 2 stops receiving security updates and bug fixes on June 30, 2026. This guide explains what actually breaks, lets you check your own build configuration in the browser, and walks through migrating to Amazon Linux 2023.
Instant compatibility checker
Paste a Dockerfile, an /etc/os-release file, a Packer or Terraform snippet, EC2 user data, or any yum-based provisioning script. The checker flags patterns that break on Amazon Linux 2023 and explains what to change.
What end of life actually means
End of support (EOS) on June 30, 2026 is the date AWS stops shipping updates for Amazon Linux 2. Concretely:
- No more security patches. The core repository stops receiving CVE fixes and bug fixes. Any new vulnerability discovered after that date goes unpatched on AL2.
- AMI deprecation. AWS deprecates the AL2-based Amazon ECS-optimized and Amazon EKS-optimized AMIs. Managed node groups and ECS capacity providers that still reference AL2 AMIs should be moved to AL2023 AMIs before the deadline.
- Existing instances keep running. EOL does not shut anything down. Your running EC2 instances continue to operate, but they become progressively riskier to keep online because the OS is frozen at its last patch level.
- No in-place upgrade. There is no supported command to convert an AL2 host into AL2023. Migration means launching or building fresh AL2023 images.
Amazon Linux 2 vs Amazon Linux 2023: key differences
These are the changes most likely to break automation, container images, and provisioning scripts.
| Area | Amazon Linux 2 | Amazon Linux 2023 | What it means for you |
|---|---|---|---|
| Package manager | yum | dnf (a yum shim exists but is deprecated) | Prefer dnf in scripts. yum still resolves to dnf, but rely on dnf semantics. |
| Extra packages | amazon-linux-extras topics | Removed | Packages such as nginx, PostgreSQL, and others are installed directly with dnf install, no extras enable step. |
| Repositories | Single rolling repo, latest always | Deterministic, version-locked repos (releasever) | Updates are opt-in and reproducible. Builds pin a specific version instead of always pulling latest. |
| Python | Python 2.7 present; /usr/bin/python often Python 2 | Python 2 removed; Python 3 only (3.9) | Anything invoking python/python2 or relying on the Python 2 interpreter must move to Python 3. |
| Time sync | historically ntpd-based tooling | chrony (with Amazon Time Sync) | Remove ntp/ntpd packages and config; use chrony. |
| Firewall | legacy iptables | nftables backend (iptables-nft) | Raw iptables rule scripts and iptables-services assumptions should be reviewed against nftables. |
| Control groups | cgroup v1 | cgroup v2 (unified hierarchy) | Container runtimes and resource-limit tooling must support cgroup v2. |
| Scheduled tasks | cron | systemd timers (cron still available) | Review crontab-based provisioning; systemd timers are the documented approach. |
| Init logging | rsyslog | systemd journal | Log shippers reading /var/log/messages may need to read the journal instead. |
| SELinux | permissive / not enforced by default | Available and can be enforced | Workloads should be tested under SELinux policies. |
| Instance metadata | IMDSv1 commonly used | AL2023 AMIs default to IMDSv2-only | Code reading instance metadata must use the IMDSv2 token flow. |
| Base OS image tag | amazonlinux:2 | amazonlinux:2023 | Update container base images and any AMI lookups that match amzn2. |
Migration checklist: AL2 to AL2023
- Inventory where AL2 is used. Container base images (
FROM amazonlinux:2), EC2 launch templates and AMI IDs, EKS/ECS node AMIs, Packer templates, and Terraform AMI data sources. - Run the checker above against each Dockerfile, user-data script, and provisioning playbook to surface the concrete breaking patterns.
- Switch package commands from
yumtodnfand replace everyamazon-linux-extras install Xwith a directdnf install X. - Remove Python 2 dependencies. Repoint scripts to
python3and verify any tooling that assumed/usr/bin/pythonwas Python 2. - Pin a releasever. Adopt the deterministic repository model so builds are reproducible instead of relying on a rolling latest.
- Update base images and AMIs. Move container images to
amazonlinux:2023and switch launch templates / node groups to AL2023 AMIs. - Validate runtime assumptions. Confirm cgroup v2, IMDSv2 token usage, chrony for time sync, and nftables-compatible firewall rules.
- Test, then cut over. Build the AL2023 image, run your full test suite, deploy to a canary, then roll out before June 30, 2026.
Automate the inventory
The open-source EOLkits CLI runs the same checks across an entire repository or image set, so you do not have to paste files one at a time.
Next steps
Frequently asked questions
When does Amazon Linux 2 reach end of life?
June 30, 2026. After that date AWS no longer provides security updates, bug fixes, or new packages for Amazon Linux 2.
What happens to my instances after the EOL date?
Running EC2 instances continue to operate, but they stop receiving patches. AWS also deprecates the AL2-based ECS-optimized and EKS-optimized AMIs, so managed compute should move to AL2023 AMIs.
Can I upgrade AL2 to AL2023 in place?
No. AL2023 is a new major release with no supported in-place upgrade. You launch new AL2023 instances or rebuild your images on AL2023.
What is the biggest breaking change?
The move from yum to dnf, the removal of amazon-linux-extras, the removal of Python 2, and deterministic version-locked repositories replacing the AL2 rolling repository.
Is Amazon Linux 2023 free, and how long is it supported?
Yes, AL2023 is provided at no additional cost beyond compute, and each AL2023 release receives five years of support.