Examkin

Question

Difficulty: HardElastic Load Balancing Health Checks and Troubleshooting

An organization runs an API service on AWS Fargate tasks registered to an Application Load Balancer (ALB) target group using the 'ip' target type. The API receives client requests over HTTPS on port 8443, but the backend application container exposes an HTTP endpoint on port 8080 specifically for health status monitoring. The SysOps Administrator notices that the target group shows all Fargate tasks as unhealthy with the description 'Health checks failed with a connection timeout'. Which two actions should the administrator take to resolve this health check issue? (Select TWO.)

  1. Modify the target group settings to specify port 8080 as the health check port.Answer
  2. Update the ECS Fargate tasks' security group to allow inbound traffic on port 8080 from the Application Load Balancer's security group.Answer
  3. C
    Change the Route 53 routing policy to active-passive failover and associate the Route 53 health check directly with the individual ECS Fargate task private IP addresses.
  4. D
    Update the outbound rules of the public subnet's Network Access Control List (NACL) to deny outbound ephemeral port ranges (1024-65535) to secure the health check path.
  5. E
    Modify the target group's health check configuration to use HTTP over port 8443 and configure the Fargate tasks to redirect all port 8080 health check probes to port 8443.

Answer

Modify the target group settings to specify port 8080 as the health check port, and update the ECS Fargate tasks' security group to allow inbound traffic on port 8080 from the Application Load Balancer's security group.
The correct configuration requires overriding the target group's default health check port to port 8080 since that is where the backend application is listening for health status probes. In addition, the security group of the ECS Fargate tasks must permit inbound traffic on port 8080 from the Application Load Balancer's security group to allow the health check probes to pass through.

Step-by-Step Solution

1
Analyze the reported error message.
The target group reports 'Health checks failed with a connection timeout', indicating that the ALB cannot establish a network connection to the targets on the designated health check port.
Identifying the root cause requires recognizing that connection timeouts are network or firewall-related, rather than application response errors (like 4xx/5xx codes).
2
Check port configuration alignment.
The API receives client traffic on port 8443, but the health monitoring endpoint runs on port 8080. The target group must be explicitly configured to override the traffic port for health checks and use port 8080 instead.
By default, target groups send health probes to the same port configured for traffic. If the health check endpoint is on a different port, it must be overridden.
3
Check security group ingress rules.
The Fargate tasks' security group needs to permit inbound traffic on port 8080 from the security group of the ALB.
Even if the target group is correctly configured, the Fargate container firewall will drop health check packets on port 8080 if the ingress rules do not explicitly permit it.

Key Concept

ELB Target Group Health Check Port Overrides and Target Security Group Configurations
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic