Amazon Linux 2 end-of-life: migration checklist (AL2 → AL2023)

Amazon Linux 2 reached end of life 2026-06-30. Standard support ended and migration is due. AWS has published post-EOL AL2 releases, so verify the installed release and current support terms instead of assuming a host patch state from the calendar alone. [AWS source]

Inspect the al2023-gate CLI coverage →

What changes on AL2023

The checklist

  1. Inventory. Find AL2 AMIs, launch templates, EKS node groups, ECS task definitions, Beanstalk platforms, and container base images. Use the documented al2023-gate modes and verify the result against AWS inventory.
  2. Rebuild the base AMI on AL2023 (Packer/EC2 Image Builder), then bake your app layers on top.
  3. Package manager. Move yum usage to dnf and drop amazon-linux-extras — install packages directly, version-namespaced, or via SPAL. (extras fix · missing-package fix)
  4. Time sync. Replace ntpd with chronyd. (ntpd fix)
  5. Firewall. Move iptables rules to nftables.
  6. Python. AL2023 ships no Python 2 — port python2 scripts/shebangs to python3. (python2 fix)
  7. Test boot, app start, networking, and time sync on a canary instance.
  8. Roll out with a staged canary (5 → 25 → 50 → 100%) and a tested rollback to the previous AMI.

Do it faster

The free scanner and the MIT al2023-gate CLI detect and patch configured source patterns. Need a review artifact? The repository evidence report ($299, 30-day money-back) returns exact observed file/line matches and a remediation order. See the full Amazon Linux 2 migration guide.