Amazon Linux 2023 Python: Install 3.13 or 3.14 with pip and venv, Why python3 Stays 3.9, and the One Change That Breaks dnf

On Amazon Linux 2023, python3 is Python 3.9, and it will stay 3.9 for the whole life of AL2023, because the operating system's own tools, including the dnf package manager, run on it. To use a newer Python, install it alongside: sudo dnf install -y python3.13 python3.13-pip gives you python3.13 and pip3.13, and Python 3.11, 3.12 and 3.14 install the same way. Here's the part that surprises people: the 3.9 on a fresh AL2023 server today is 3.9.25, the final release of a Python version that reached end of life upstream on October 31, 2025. So the system Python is for the system, and your applications belong on 3.13 or 3.14 in a virtual environment. And whatever a forum post suggests, never repoint /usr/bin/python3 to the new version: dnf itself starts with #!/usr/bin/python3, so changing it can break package management on the server. This page shows the versions available today, how to install and use them with pip and venv, why dnf install python3-requests doesn't help your new Python, and how to get a version AL2023 doesn't package, such as 3.10.

Ethan, a developer, moved the small server that runs the website and booking system for his friend Jake's phone repair shop from Amazon Linux 2 to Amazon Linux 2023. He typed python3 --version, expecting something new, and got 3.9. His first instinct was to point python3 at a newer version. He's glad he read the warning first.

New to Amazon Linux? It's AWS's own Linux distribution, the default choice for EC2 servers and the base of many AWS container images. Amazon Linux 2023, or AL2023, is the current version. Our guides to EC2 and AMIs cover the basics.

Which Python versions Amazon Linux 2023 has

On a fresh AL2023 server, the system Python looks like this:

python3 --version
ls -l /usr/bin/python3

Python 3.9.25
lrwxrwxrwx 1 root root 9 Jul 20 21:41 /usr/bin/python3 -> python3.9

/usr/bin/python3 is a link to python3.9, and AL2023 keeps it that way for its whole life. Newer versions come as separate packages you install side by side. This shows what's available on your server right now:

dnf list --available "python3.1[0-9]" "python3.1[0-9]-pip"

On the October 2026 release of AL2023, that's:

Each newer version is supported for as long as the Python project supports it upstream. Python 3.9 is different: upstream support ended on October 31, 2025, with 3.9.25 as the final release, but it stays AL2023's system Python because the operating system is built around it. That's the reason to leave it alone and run your own code on a newer version.

Jake: "So the server came with an old Python on purpose?"

Ethan: "For itself, yes. The system's tools were built and tested on 3.9. Our code gets its own, newer one, next to it."

Install Python 3.13 (or 3.11, 3.12, 3.14)

One command installs the interpreter and its pip. Swap the version number for the one you want:

sudo dnf install -y python3.13 python3.13-pip

Check what you got, and notice that python3 hasn't changed:

python3.13 --version
pip3.13 --version
python3 --version

Python 3.13.15
pip 24.2 from /usr/lib/python3.13/site-packages/pip (python 3.13)
Python 3.9.25

That's the design: every version lives at its own path, /usr/bin/python3.13 next to /usr/bin/python3.9, and you call the one you want by name. You can install several versions on one server. If you'll build packages with C extensions, add the headers too: sudo dnf install -y python3.13-devel gcc.

Use it properly: a virtual environment and pip

The cleanest way to run your application on the new Python is a virtual environment, a folder with its own copy of the interpreter's settings and its own packages. Create it with the version you installed, install your packages inside it, and run your code with its Python:

sudo mkdir -p /opt/shop && sudo chown "$USER" /opt/shop
python3.13 -m venv /opt/shop/venv
/opt/shop/venv/bin/pip install requests
/opt/shop/venv/bin/python -c "import platform, requests; print(platform.python_version(), requests.__version__)"

3.13.15 2.34.2

Inside the virtual environment, python and pip mean 3.13, so you can also source /opt/shop/venv/bin/activate in a terminal and use the short names. For a service, point its start command at the full path, /opt/shop/venv/bin/python app.py, and the service uses the right Python whatever python3 means on the server.

For a real application, the whole move looks like this:

1. Install the version your app needs: sudo dnf install -y python3.13 python3.13-pip.
2. Create the virtual environment next to the app: python3.13 -m venv /opt/shop/venv.
3. Install the app's libraries into it: /opt/shop/venv/bin/pip install -r requirements.txt.
4. Change the service's start command, for example ExecStart= in a systemd unit, to /opt/shop/venv/bin/python app.py.
5. Restart the service and check its log for the Python version it reports.

pip may tell you a newer version of pip exists. Inside a virtual environment, upgrading it is safe: /opt/shop/venv/bin/pip install --upgrade pip.

Don't repoint python3: dnf runs on it

The most common advice for "how do I make python3 point to 3.13" is to change the symlink with ln -sf or alternatives. On AL2023, don't. Look at the first line of the package manager itself:

head -1 /usr/bin/dnf

#!/usr/bin/python3

dnf is a Python program, and it runs on whatever /usr/bin/python3 is. Its modules are installed for Python 3.9 only. Point python3 at 3.13, and dnf doesn't even start. This is what any dnf command prints after that change:

Traceback (most recent call last):
  File "/usr/bin/dnf", line 61, in <module>
    from dnf.cli import main
ModuleNotFoundError: No module named 'dnf'

That leaves you with a server that can't install anything, including its own security updates. On AL2023, /usr/bin/python3 belongs to the operating system; it isn't a setting for you to change. And there's nothing to switch with alternatives anyway: AL2023 doesn't manage python3 through it, so alternatives --display python3 prints nothing.

What to do instead, for each place you'd be tempted to change it:

Jake: "So changing one link could stop the server from installing its own updates?"

Ethan: "Exactly. The update tool is written in Python and expects 3.9. Break its Python, and you've broken the thing that fixes everything else."

Why dnf install python3-requests doesn't help Python 3.13

AL2023 packages many Python libraries as RPMs, named python3-something. Those are built for the system Python, 3.9, so they don't help your new version:

sudo dnf install -y python3-requests
python3 -c "import requests; print(requests.__version__)"
python3.13 -c "import requests"

2.25.1
ModuleNotFoundError: No module named 'requests'

Python 3.9 got requests 2.25.1, an old release, and Python 3.13 got nothing. A few popular libraries do have versioned packages, such as python3.13-cryptography or python3.13-dateutil, but for an application, install your libraries with pip inside its virtual environment. That way you choose the versions, and the operating system's packages stay untouched.

The same goes for the system's own pip. AL2023 doesn't install it by default; after sudo dnf install python3-pip, a sudo pip3 install writes straight into the system Python's packages with only a warning. That's different from Kali, where pip refuses with an externally-managed-environment error; AL2023 doesn't stop you. That's how a library upgrade breaks dnf or another system tool months later. Keep pip inside virtual environments.

pip install mysqlclient fails: "Can not find valid pkg-config name"

One of the most common Python questions on AL2023 isn't about Python at all. It's this, from pip install mysqlclient in a fresh virtual environment:

Trying pkg-config --exists mysqlclient
Command 'pkg-config --exists mysqlclient' returned non-zero exit status 1.
Trying pkg-config --exists mariadb
Command 'pkg-config --exists mariadb' returned non-zero exit status 1.
Trying pkg-config --exists libmariadb
Command 'pkg-config --exists libmariadb' returned non-zero exit status 1.
Trying pkg-config --exists perconaserverclient
Command 'pkg-config --exists perconaserverclient' returned non-zero exit status 1.
Exception: Can not find valid pkg-config name.

On a server where pkg-config itself isn't installed yet, each line ends in exit status 127 instead of 1; the cause and the fix are the same. mysqlclient is a C extension. pip has to compile it, and to do that it needs a compiler, your Python version's headers and the MySQL client library's headers. A fresh AL2023 server has none of them. AL2023 has several MariaDB packages, and the smallest one that works is the connector:

1. Install the build tools and headers: sudo dnf install -y gcc python3.13-devel mariadb-connector-c-devel.
2. Install mysqlclient in your virtual environment: /opt/shop/venv/bin/pip install mysqlclient.
3. Check that it imports: /opt/shop/venv/bin/python -c "import MySQLdb; print(MySQLdb.version_info)".

Use the -devel package for the Python version your venv uses: python3.12-devel for a 3.12 venv, and so on. If you'd rather not compile anything, pip install pymysql is a pure-Python MySQL driver that installs with no extra packages, if your code or framework can use it.

Jake: "So the error was about a missing part, not a broken database?"

Ethan: "A missing part list. pip went looking for the MySQL headers, found nothing, and gave up with the least helpful sentence it had."

A version AL2023 doesn't package, such as Python 3.10

AL2023 offers 3.9 and 3.11 through 3.14, but not 3.10. If an application is pinned to a version that isn't packaged, uv can download a standalone build into your home folder without touching the system. Install uv into its own small virtual environment, then let it fetch the version and build a virtual environment with it:

python3.13 -m venv ~/uvtool && ~/uvtool/bin/pip install uv
~/uvtool/bin/uv python install 3.10
~/uvtool/bin/uv venv --python 3.10 ~/legacy-app/venv
~/legacy-app/venv/bin/python --version

Python 3.10.22

uv may warn that its own Python folder isn't on your PATH; that only matters if you want to run that Python by name, since the virtual environment already points at it. For anything AL2023 does package, prefer the dnf package: it gets security updates with the rest of the system.

On EC2: install it at launch

To have a new EC2 instance come up with Python 3.13 and your app's environment ready, put the steps in the instance's user data:

#!/bin/bash
dnf install -y python3.13 python3.13-pip
mkdir -p /opt/shop
python3.13 -m venv /opt/shop/venv
/opt/shop/venv/bin/pip install requests

User data runs as root once, at first boot, so no sudo is needed. If the app isn't there when you connect, open /var/log/cloud-init-output.log: every line the script printed is in it, including any dnf or pip error. If your code calls AWS from the instance, give it an IAM role rather than keys; our boto3 credentials guide covers the common mistakes.

In Docker and on Lambda

In a container built FROM amazonlinux:2023, the same commands work in a RUN line: RUN dnf install -y python3.13 python3.13-pip && dnf clean all. Then create the virtual environment in another RUN line and point CMD at its Python.

Lambda is different. Its Python runtimes, such as python3.13, come with their own Python, so you don't install Python there at all; you choose the runtime. The Python 3.12 and later Lambda runtimes run on Amazon Linux 2023, so packages with compiled code should be built for it. Our Lambda package guide shows how to build Python packages for it and keep them under the size limit.

Troubleshooting by symptom

python3 --version shows 3.9 after installing 3.13

That's expected. Run python3.13 by name, or use a virtual environment created with python3.13.

dnf: ModuleNotFoundError: No module named 'dnf'

python3 was pointed at another version. Point it back with sudo ln -sf python3.9 /usr/bin/python3, and dnf works again. Then use python3.13 by name.

No module named 'requests' after dnf install python3-requests

The RPM installed it for Python 3.9. Install it with pip inside your Python 3.13 virtual environment.

pip3: command not found

AL2023 doesn't install pip for the system Python. Use pip3.13 from python3.13-pip, or pip inside a virtual environment.

No match for argument: python3.10

AL2023 doesn't package 3.10. Use 3.11 or later, or install 3.10 with uv.

Exception: Can not find valid pkg-config name

pip install mysqlclient can't find the MySQL headers. Install gcc, python3.13-devel and mariadb-connector-c-devel, then retry.

error: command 'gcc' failed during pip install

The package needs to compile C code. Install gcc and the headers for your version, such as python3.13-devel.

Python on Amazon Linux 2023: frequently asked questions

Ethan left python3 exactly as it was. He installed python3.13, built a virtual environment in /opt/shop, and pointed the booking service at /opt/shop/venv/bin/python. The next security update installed without a hitch, which is the whole reason he hadn't touched the link. Jake's only comment was that the booking page loaded faster, which Ethan decided not to argue with.

Revision note. Written October 13, 2026, on Amazon Linux 2023 release 2023.12.20261012. "Let sleeping dogs lie," says the old proverb; on AL2023, the sleeping dog is /usr/bin/python3.