A company hosts a containerized web application on Amazon EC2 instances within a private s… — AWS Certified Solutions Architect - Associate

A company hosts a containerized web application on Amazon EC2 instances within a private subnet. The instances are managed by an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The application listens on custom TCP port $8080$ . The ALB's target group is configured to route traffic to port $8080$ , but its health check is configured to use the default HTTP port $80$ . As a result, all newly launched EC2 instances fail the ALB health check and are terminated by the ASG.

The security group assigned to the EC2 instances allows inbound TCP traffic on port $8080$ from the ALB security group, and allows all outbound traffic. The private subnet's Network ACL allows inbound traffic on port $8080$ and port $80$ , but its outbound rule only allows traffic to destination ports $80$ and $443$ to allow for package updates.

Which two actions should a solutions architect take to resolve the health check failures and allow the instances to receive application traffic? (Select two.)

Modify the target group health check settings to perform health checks on port $8080$ instead of the default port.Cevap
Update the outbound Network ACL rules of the private subnet to allow traffic to ephemeral ports $1024-65535$ .Cevap
C
Update the security group of the EC2 instances to allow outbound TCP traffic on port $8080$ and port $80$ to the Application Load Balancer.
D
Modify the target group configuration to enable stickiness and change the target type from instance to ip.
E
Configure an Amazon Route 53 latency routing policy with health checks to route client requests directly to the EC2 instances, bypassing the Application Load Balancer.

Cevap

The correct actions are to modify the target group health check settings to perform health checks on port

8080

instead of the default port, and to update the outbound Network ACL rules of the private subnet to allow traffic to ephemeral ports

1024-65535

The correct actions resolve the two root issues preventing successful health checks. First, correcting the health check port ensures that the load balancer queries the active application service running on port

8080

instead of the default port

80

. Second, opening the outbound Network ACL to ephemeral ports allows the stateless firewall to permit the return packets of the TCP connections initiated by the load balancer nodes.

Adım Adım Çözüm

Analyze why the health check fails on port

80

The application only listens on port

8080

, so requests sent to port

80

receive no response, marking the targets as unhealthy.

To identify the mismatch between where the application is listening and where the load balancer is sending health checks.

Analyze the stateless Network ACL behavior on return traffic.

Although inbound traffic on port

8080

is allowed, return traffic from the EC2 instances back to the Application Load Balancer's ephemeral client ports is blocked by the restricted outbound Network ACL.

To understand why TCP handshakes fail even if the health check port is corrected.

Determine the necessary corrections to allow traffic flow.

Modify the health check settings to target port

8080

and update the outbound Network ACL rules to allow TCP traffic to ephemeral ports

1024-65535

To align the health check destination with the active application port and permit stateless return packets to reach the load balancer.

Anahtar Kavram

Ensuring health check port alignment and configuring stateless Network ACLs for ephemeral port return traffic in a load-balanced Auto Scaling architecture.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru