Examkin

Question

Difficulty: HardElastic Load Balancing Health Checks and Troubleshooting

A SysOps administrator has configured an Application Load Balancer (ALB) to terminate SSL/TLS traffic and forward requests to a target group of EC2 instances over HTTP on port 80. To ensure all client connections are secure, the administrator added a rewrite rule to the Apache web server configuration on the EC2 instances to redirect all incoming HTTP traffic to HTTPS.

Following this change, users receive a 'Too many redirects' error in their web browsers, and the ALB target group shows all EC2 instances as unhealthy with an HTTP 301 response.

Which action should the administrator take to resolve these issues?

  1. Modify the Apache rewrite rule on the EC2 instances to only redirect traffic if the X-Forwarded-Proto header is 'http'.Answer
  2. B
    Update the target group health check configuration's matcher settings to accept a success code of '301'.
  3. C
    Configure an Amazon Route 53 failover routing policy to route all port 80 traffic to a secondary target group.
  4. D
    Update the target group's port configuration to forward traffic to the EC2 instances over HTTPS on port 443.

Answer

Modify the Apache rewrite rule on the EC2 instances to only redirect traffic if the X-Forwarded-Proto header is 'http'.
Modifying the rewrite rule to check the X-Forwarded-Proto header is the correct solution because it allows the EC2 instances to distinguish between client requests that were already secured (which should not be redirected) and health check or unsecured requests (which do not need redirection or can be handled separately). This stops the infinite redirect loop and allows HTTP health checks on port 80 to return 200 OK.

Step-by-Step Solution

1
Analyze the request flow between the client, the ALB, and the backend EC2 instances.
The ALB terminates SSL/TLS and forwards requests to the EC2 instances over HTTP (port 80). The EC2 instances redirect all HTTP traffic to HTTPS (301 redirect), creating a loop for clients and causing health checks to return 301 instead of 200 OK.
To identify why the 'Too many redirects' error occurs and why the target group health checks are failing.
2
Identify how the ALB communicates the original protocol to the backend EC2 instances.
The ALB appends the X-Forwarded-Proto header (with a value of 'https' for client HTTPS connections and 'http' for client HTTP connections).
To find a header that the EC2 instances can inspect to distinguish between original HTTP and HTTPS client connections.
3
Modify the rewrite rule on the backend Apache web servers to evaluate the X-Forwarded-Proto header.
Rewrite rules will only trigger a redirect to HTTPS if the header is explicitly set to 'http'. Since ALB health check requests do not include this header, they bypass the redirect and return 200 OK.
To resolve both the infinite redirect loop for clients and the health check failures on port 80.

Key Concept

Application Load Balancer health checks and request routing header forwarding (X-Forwarded-Proto) during SSL termination.
Estimated Time:2m 30s
Rate this question

Topics

Elastic Load Balancing Health Checks and Troubleshooting

More questions from this topic