STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023 must enable FIPS mode.

DISA Rule

SV-283441r1192638_rule

Vulnerability Number

V-283441

Group Title

SRG-OS-000033-GPOS-00014

Rule Version

AZLX-23-000050

Severity

CAT I

CCI(s)

CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.

Weight

Fix Recommendation

Configure the Amazon Linux 2023 to implement FIPS mode with the following command:

$ sudo fips-mode-setup --enable

To ensure the kernel enables FIPS mode for early boot, "fips=1" must be added to the grub config:
$ sudo grubby --update-kernel=ALL --args="fips=1"

Verify the setting with the following command:
$ cat /proc/cmdline
BOOT_IMAGE=(hd0,gpt2)/vmlinuz-5.14.0-570.21.1.el9_6.x86_64 root=/dev/mapper/rhel-root ro resume=/dev/mapper/rhel-swap rd.luks.uuid=luks-cd37eb8d-a2c3-4671-96ee-1e6a3a681561 rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet fips=1 boot=UUID=acbbb4ee-adc0-4cb2-9546-afab857b8849 audit_backlog_limit=8192 crashkernel=1G-4G:192M,4G-64G:256M,64G-:512M

Reboot the system for the changes to take effect.

Check Contents

Verify Amazon Linux 2023 is in FIPS mode with the following command:

$ sudo fips-mode-setup --check
FIPS mode is enabled.

If FIPS mode is not enabled, this is a finding.

If any other lines are returned by the above command, run the following command to see the currently applied crypto-policy:

$ update-crypto-policies --show
FIPS

If the policy is not "FIPS" or a FIPS policy authorized by and documented with the ISSO, this is a finding.

Vulnerability Number

V-283441

Documentable

False

Rule Version

AZLX-23-000050

Severity Override Guidance

Check Content Reference

Target Key

5700