Kernel live patches are available for Amazon Linux 2 with kernel version 4.14.165-131.185 or later. To check your kernel version, run the following command.

[root@actsupport ~]#  yum list kernel

If you already have a supported kernel version, skip this step. If you do not have a supported kernel version, run the following commands to update the kernel to the latest version and to reboot the instance.

[root@actsupport ~]#  sudo yum install -y kernel
[root@actsupport ~]#  reboot

Install the yum plugin for Kernel Live Patching.

[root@actsupport ~]#  yum install -y yum-plugin-kernel-livepatch

Enable the yum plugin for Kernel Live Patching.

[root@actsupport ~]#  yum kernel-livepatch enable -y

This command also installs the latest version of the kernel live patch RPM from the configured repositories.

To confirm that the yum plugin for kernel live patching has installed successfully, run the following command.

[root@actsupport ~]#  rpm -qa | grep kernel-livepatch

When you enable Kernel Live Patching, an empty kernel live patch RPM is automatically applied. If Kernel Live Patching was successfully enabled, this command returns a list that includes the initial empty kernel live patch RPM.

Update and start the kpatch service. This service loads all of the kernel live patches upon initialization or at boot.

[root@actsupport ~]#  yum update kpatch-runtime
[root@actsupport ~]#  systemctl enable kpatch.service

Configure the Amazon Linux 2 Kernel Live Patching repository, which contains the kernel live patches.

[root@actsupport ~]#  amazon-linux-extras enable livepatch

Please note: This does not work if only security updates are selected, due to the fact that security updates are not properly flagged in centos and amazon linux. This may be a matter of Redhat making security a paid feature which, if I'm being frank, is bullshit. For this to work you must update the yum-cron config file to install all updates. This makes security updates less likely to run reliably which makes everyone less secure.

update_cmd = default

Amazon Linux runs updates when the host boots for the first time. If you plan to have hosts up long-term you may also want to enable automatic security updates. I recommend using yum-cron:

sudo yum install yum-cron

The config file is here: (you probably want to just run security updates)

/etc/yum/yum-cron.conf

You can then enable yum-cron like so:

sudo service yum-cron start

edit from a useful comment below: "If you're creating/destroying instances with an auto-scaling group, etc, the command should be something like "sudo yum update -y" in user data."

systemd timers replaced cron in AL2023, so ggrandes' answer did not work for me.

I was able to set up a systemd timer quite easily though.

First create /etc/systemd/system/dnf-security-upgrade.service with the following contents:

[Unit]
Description=Automatic security upgrades for dnf packages

[Service]
Type=oneshot
ExecStart=/usr/bin/dnf upgrade --security --assumeyes --releasever=latest

Then create /etc/systemd/system/dnf-security-upgrade.timer with the following contents:

[Unit]
Description=Timer for automatic security upgrades for dnf packages

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

Now, reload the systemd daemon with:

systemctl daemon-reload

Finally, run the following command to start the timer:

systemctl enable --now dnf-security-upgrade.timer