The latest articles on DEV Community by SunsetSignal (@sunsetsignal). https://dev.to/sunsetsignal https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3998087%2Fa49fb0c4-eb72-4129-91ce-181c0e8daac1.png https://dev.to/sunsetsignal en SunsetSignal Thu, 25 Jun 2026 06:39:16 +0000 https://dev.to/sunsetsignal/amazon-linux-2-reaches-eol-on-june-30-heres-what-breaks-and-how-to-stay-compliant-47bj https://dev.to/sunsetsignal/amazon-linux-2-reaches-eol-on-june-30-heres-what-breaks-and-how-to-stay-compliant-47bj <p>Amazon Linux 2 (AL2) reaches end-of-life on June 30, 2026. If you're still on it, here's what actually breaks — and the part that turns it from tech debt into an audit problem.</p> <h2> Where it bites </h2> <p><strong>EKS.</strong> AL2-based EKS AMIs stop receiving kernel updates. Move your node groups to AL2023 or Bottlerocket before the cutoff.</p> <p><strong>Lambda.</strong> Runtimes and base images still on AL2 — Java 8 on AL2, <code>provided.al2</code>, older Python — lose patching. Move to the AL2023-based runtimes AWS is shipping.</p> <h2> Why it's a compliance problem, not just tech debt </h2> <p>Running an unsupported OS is a direct finding in SOC 2 and ISO 27001 audits — supported software is an explicit requirement. PCI DSS 4.0 goes further and requires an end-of-life management program. So an unpatched AL2 box isn't just risky; it can cost you a certification, and with it customer contracts.</p> <h2> A 3-step check before it bites </h2> <ol> <li> <strong>Inventory by runtime across ALL accounts and regions.</strong> A single-region CLI query misses things — this is where teams get caught.</li> <li> <strong>Test on the AL2023 target in staging.</strong> Most breakages are in native dependencies, not your code.</li> <li> <strong>Capture the evidence.</strong> Note the migration in your compliance documentation so it doesn't surprise you at audit time.</li> </ol> <h2> The bigger pattern </h2> <p>AL2 is one of dozens of these. The notices are scattered across changelogs and lifecycle pages, one per provider — so most teams find out during an audit or after an outage, not before.</p> <p>That's exactly why I started <strong>SunsetSignal</strong>: a free, 5-minute weekly brief on the deprecations, EOLs and breaking changes hitting serverless &amp; AWS teams — curated, prioritized, with what to do and why it matters for compliance. If that's useful: <a href="https://sunsetsignal.com" rel="noopener noreferrer">https://sunsetsignal.com</a></p> <p>What's the last deprecation that caught your team off guard?</p> aws devops cloud security