STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023 must have GPG signature verification enabled for all software repositories.

DISA Rule

SV-273998r1119982_rule

Vulnerability Number

V-273998

Group Title

SRG-OS-000366-GPOS-00153

Rule Version

AZLX-23-000125

Severity

CAT I

CCI(s)

CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

Fix Recommendation

Configure Amazon Linux 2023 to verify the signature of packages from a repository prior to installation by setting the following option in the "/etc/yum.repos.d/[your_repo_name].repo" file:

gpgcheck=1

Check Contents

Verify Amazon Linux 2023 software repositories enforce a signature check on the packages prior to allowing installation with the following command:

$ grep -w gpgcheck /etc/yum.repos.d/*.repo | more
/etc/yum.repos.d/amazonlinux.repo:gpgcheck=1
/etc/yum.repos.d/amazonlinux.repo:gpgcheck=1
/etc/yum.repos.d/amazonlinux.repo:gpgcheck=1
/etc/yum.repos.d/kernel-livepatch.repo:gpgcheck=1
/etc/yum.repos.d/kernel-livepatch.repo:gpgcheck=1

If any repository has "gpgcheck=0" or "False", or if the option is commented out, this is a finding.

Vulnerability Number

V-273998

Documentable

False

Rule Version

AZLX-23-000125

Severity Override Guidance

Check Content Reference

Target Key

5700