All posts
AWS Architecture

Amazon Linux 2027 Preview: What Changes From AL2023, and How to Get Ready

By

October 25, 2026

6 min read

AL2027 entered public preview in September 2026 with kernel 7.1, SELinux enforcing by default, post-quantum key exchange on by default, DNF5, Python 3.14, GCC 16 and AWS-LC alongside OpenSSL 3.5. The changes most likely to break your builds and AMIs, and a sensible way to test before it is generally available.

Amazon Linux 2027
AL2023
Linux
SELinux
Post-Quantum Cryptography
2027

AWS opened the public preview of Amazon Linux 2027 in September 2026, with preview AMIs in all commercial Regions for x86 and Arm and container base images on ECR Public. The preview runs into early 2027 and is for testing, not production. AL2023 remains the current release.

Want a second opinion on this for your system?

Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.

The changes that matter

Component

AL2023

AL2027 preview

Why you care

SELinux

Permissive

Enforcing by default

Software writing to unusual paths or binding unusual ports will be denied until policies are set

Kernel

6.1 default; 6.12 and 6.18 available

7.1

Versioned kernel package names

Package manager

DNF 4

DNF5 (dnf and yum run DNF5)

Scripts using the python3-dnf API break; use python3-libdnf5

Default Python

3.9

3.14

System Python scripts and tooling need testing

Toolchain

GCC 11.5, glibc 2.34

GCC 16.1, glibc 2.44

Stricter compiler defaults surface new warnings and errors

systemd

252

260, without System V init script support

Old init scripts must become unit files

RPM

4.16

6.0

Test custom spec files

Cryptography

OpenSSL 3

OpenSSL 3.5 default, PQC key exchange on by default, AWS-LC available

Older clients and appliances may fail TLS or SSH negotiation

Package installs

Manual cooldown config

npm and pip dependency cooldowns on by default

Brand-new package versions install after a delay, by design

From AWS's AL2023 to AL2027 comparison guide, October 2026 preview.

How to get ready

  1. Build a test AMI or container image on the preview and run your application's test suite on it.

  2. Run with SELinux enforcing and collect denials. Most of the work is writing small policy modules for paths and ports your software uses.

  3. Grep for yum, dnf Python API usage and init.d scripts in AMI builds, user data and configuration management.

  4. Test outbound connections to old internal systems: post-quantum hybrid key exchange and newer TLS defaults expose ancient servers.

  5. Do not migrate production yet. Plan the move for after general availability, and put AL2023 instances on your 2027 roadmap.

hoolco Monthly Review

Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.

As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.