Amazon Linux 2027 preview

AL2027 currently combines a 7.1 or newer Linux kernel with current toolchains and language runtimes. It moves package operations to DNF5, provides AWS-LC alongside OpenSSL 3.5 and targets modern x86-64 and Arm hardware. Each change can affect build scripts, package names, native extensions, image pipelines and assumptions embedded in configuration management.

The most visible security change is SELinux in enforcing mode by default. Amazon Linux 2023 uses permissive mode by default, where policy denials are logged but not enforced. An application that writes to an unexpected path, starts a service with incomplete labels or relies on a broad local permission can therefore behave differently on AL2027 even when its conventional Unix ownership appears correct.

OpenSSH also arrives with stricter defaults. DSA signatures are no longer available, RSA keys shorter than 2048 bits are rejected by default and post-quantum key exchange is enabled. These are sensible modernisations, but old deployment users, automation hosts and emergency access procedures need explicit testing before the operating system becomes part of a production image.

A successful boot proves very little about a web application. Rebuild the environment through the same infrastructure-as-code and configuration workflow used elsewhere. Install the runtime and services, apply system users and file permissions, restore representative data, deploy the application and run its scheduled and asynchronous work.

Exercise the paths that usually stay outside a smoke test: image and document processing, outbound TLS calls, background queues, database client libraries, log shipping, monitoring agents, backup jobs, service restarts and deployment rollbacks. Review SELinux audit output while the workload runs so a silent dependency does not become a production failure later.

Infrastructure automation deserves its own compatibility result. Test AMI discovery, package repositories, DNF5 commands, custom RPMs, Ansible roles, container builds and bootstrap scripts. If an environment is immutable, prove that a replacement instance reaches service and joins monitoring correctly. If it is maintained in place, prove how updates and reboots are controlled.

The preview should produce an inventory of blockers, not a fixed migration date. Classify findings by application code, runtime, package, configuration policy, hardware baseline and operational tooling. Some issues can be resolved immediately because they reveal weak assumptions in the current environment. Others should wait for the AL2027 release to stabilise.

AWS says preview AMIs will be deprecated when AL2027 reaches general availability and will stop receiving updates. A test environment therefore needs an explicit end state. Plan to replace preview instances with supported GA images rather than carrying the evaluation build forward as if it were production-ready.

Before adoption, repeat the test against the final image and confirm support terms, update policy, package availability and the required instance families. Then schedule the change as an application-platform release with rollback criteria, monitoring and accountable owners. An operating-system upgrade is successful only when the full service remains supportable after the change.