Amazon Linux 2023 must be a vendor-supported release.

STIG ID: AZLX-23-000130  |  SRG: SRG-OS-000439-GPOS-00195 |  Severity: high (CAT I)  |  CCI: CCI-002605 |  Vulnerability Id: V-273999

Vulnerability Discussion

An operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software. Amazon Linux 2023 (AL2023) was released in March 2023 and will be supported until June 30, 2029.

Standard support ends June 30, 2027.
Maintenance (security and critical fixes only) ends June 30, 2029.

To check the support status and dates of individual packages, use the following command:
$ sudo dnf supportinfo --pkg <packagename>

To get information on all currently installed packages, use:
$ sudo dnf supportinfo --show installed

Check

Verify Amazon Linux 2023 is a vendor-supported version with the following command:

$ cat /etc/amazon-linux-release
Amazon Linux release 2023.6.20250203 (Amazon Linux)

If the installed version of Amazon Linux 2023 is not supported, this is a finding.

Fix

Configure Amazon Linux 2023 to be a vendor supported release.

Upgrade to a supported version of Amazon Linux 2023.