View a markdown version of this page

Enable FIPS Mode on AL2027 - Amazon Linux 2027
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Enable FIPS Mode on AL2027

AL2027 Preview

AL2027 is currently available for preview. It is intended for evaluation and testing only and is not recommended for production workloads.

This section explains how to enable Federal Information Processing Standards (FIPS) on AL2027. For more information about FIPS, see:

Note

This section documents how to enable FIPS mode in AL2027, it does not cover the certification status of AL2027 cryptographic modules.

Prerequisites

  • An existing AL2027 Amazon EC2 instance with access to the internet to download required packages.

  • You must connect to your Amazon EC2 instance using SSH or Amazon Systems Manager.

Important

ED25519 SSH user keys are not supported in FIPS mode. If you launched your Amazon EC2 instance using an ED25519 SSH key pair, you must generate new keys using another algorithm (such as RSA or ECDSA) or you may lose access to your instance after enabling FIPS mode. For more information see Create key pairs in the Amazon EC2 User Guide.

Note

AL2027 no longer provides the fips-mode-setup command-line utility. FIPS mode only needs to be enabled in the Linux kernel, and after rebooting the system-wide cryptographic FIPS policy will be automatically enabled via the fips-crypto-policies dracut module or the systemd fips-crypto-policy-overlay service.

Enable FIPS Mode

  1. Connect to your AL2027 instance using SSH or Amazon Systems Manager.

  2. Ensure the system is up to date. For more information, see Manage package and operating system updates in AL2027.

  3. Ensure the crypto-policies utilities are installed and up-to-date.

    sudo dnf -y install crypto-policies crypto-policies-scripts

  4. Enable FIPS mode by running the following command:

    sudo /sbin/grubby --update-kernel=ALL --args="fips=1"

  5. Reboot the instance using the following command.

    sudo reboot

  6. To verify that the Linux kernel is in FIPS mode, reconnect to your instance and run the following command:

    cat /proc/sys/crypto/fips_enabled

    An output of 1 means that the kernel is running FIPS mode.

  7. To verify that the system-wide cryptographic policies are set to FIPS:

    update-crypto-policies --show

    The following output shows the FIPS crypto policy is enabled:

    FIPS