View a markdown version of this page

Supported CPU architectures, operating systems, and kernel versions - Amazon GuardDuty
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Supported CPU architectures, operating systems, and kernel versions

This section consolidates the CPU architectures, OS distributions, and kernel versions that have been verified to support the GuardDuty security agent. Unless a resource type is called out separately, these requirements apply to Runtime Monitoring for Amazon EC2 instances, Amazon Fargate (Amazon ECS only), and Amazon EKS clusters.

Kernel support includes eBPF, Tracepoints, and Kprobe. For CPU architectures, Runtime Monitoring supports AMD64 (x64) and ARM64 (Graviton2 and above)1.

The following table shows the OS distributions and kernel versions that have been verified to support the GuardDuty security agent.

OS distribution2 Kernel version3
Amazon Linux 2

5.44, 5.104, 5.15
Amazon Linux 2023

5.44, 5.104, 5.15, 6.1, 6.5, 6.8, 6.12
Ubuntu 20.04, 22.04, 24.04, 26.04

5.44, 5.104, 5.15, 6.1, 6.5, 6.8, 6.13, 6.14, 6.15, 6.16, 6.17, 6.18, 7.0
Debian 11, 12, 13

5.44, 5.104, 5.15, 6.1, 6.5, 6.8, 6.12
RedHat 9.4, 10.2

5.14, 6.12
Fedora 34, 40, 41, 43, 44

5.11, 5.17, 6.8, 6.12, 7.1
CentOS Stream 9, 10

5.14, 6.12
Oracle Linux 8.9, 9.3

5.15
Rocky Linux 9.5, 10.1

5.14, 6.12
Alma Linux 9, 10

5.14, 6.12
SUSE Linux Enterprise Server 16

6.12
Bottlerocket

5.44, 5.104, 5.15, 6.1, 6.18

  1. Runtime Monitoring doesn't support the first generation Graviton instance such as A1 instance types.

  2. Support for various operating systems - GuardDuty has verified Runtime Monitoring support for the operating distribution listed in the preceding table. While the GuardDuty security agent may run on operating systems not listed in the preceding table, the GuardDuty team cannot guarantee the expected security value.

  3. For any kernel version, you must set the CONFIG_DEBUG_INFO_BTF flag to y (meaning true). This is required so that the GuardDuty security agent can run as expected.

    For Amazon Fargate (Amazon ECS only), this kernel option is managed by Fargate and requires no action from you.

  4. For kernel versions 5.10 and earlier, the GuardDuty security agent uses locked memory in RAM (RLIMIT_MEMLOCK) to function as expected. If your system's RLIMIT_MEMLOCK value is set too low, GuardDuty recommends setting both hard and soft limits to at least 32 MB. For information about verifying and modifying the default RLIMIT_MEMLOCK value on Amazon EC2 instances, see Viewing and updating RLIMIT_MEMLOCK values.