Examkin

Soru

Zorluk: ZorElastic Load Balancing Health Checks and Troubleshooting

A SysOps administrator is troubleshooting an Application Load Balancer (ALB) that has marked all registered Amazon EC2 instances as unhealthy. The instances host a web application that listens on port 80 and is configured to automatically redirect all incoming HTTP traffic to HTTPS (port 443) using an application-level rewrite rule. The ALB is configured for SSL termination on port 443. The target group is configured to perform health checks on port 80 using the HTTP protocol at path `/healthz`, expecting a default response code of 200. Which of the following is the most appropriate action to resolve this issue and mark the targets as healthy?

  1. A
    Modify the target group health check configuration to use HTTPS on port 443.
  2. B
    Modify the subnet network access control list (NACL) rules to permit outbound traffic from the EC2 instances to the ALB on ephemeral ports.
  3. Update the target group health check configuration to accept HTTP 301 or 302 status codes as successful responses.Cevap
  4. D
    Configure an active-passive failover routing policy in Amazon Route 53 to redirect health check requests directly to the instance Elastic IPs.

Cevap

Update the target group health check configuration to accept HTTP 301 or 302 status codes as successful responses.
The correct answer is to update the target group health check configuration to accept HTTP 301 or 302 status codes. Because the web application redirects all incoming HTTP port 80 traffic to HTTPS, any HTTP health check request to the path `/healthz` on port 80 will return a redirect status code (301 or 302) instead of 200. Since the default ALB target group health check only considers 200 as successful, the instances are marked unhealthy. Adding 301 and 302 to the target group's expected health check response codes resolves this discrepancy.

Adım Adım Çözüm

1
Analyze the architecture and identify that SSL termination occurs at the Application Load Balancer (ALB).
The backend EC2 instances receive unencrypted HTTP traffic on port 80 and do not handle SSL termination.
Knowing where SSL terminates determines whether the backend targets are expected to respond to HTTPS requests.
2
Examine the application-level redirection rule implemented on the EC2 instances.
HTTP requests targeting the instances (including the ALB health checks sent on port 80) are redirected to HTTPS, generating an HTTP 301 or 302 response.
Identifying the response code returned by the backend instances is critical to understanding why the load balancer marks them as unhealthy.
3
Review the target group health check configuration.
The target group expects an HTTP 200 response code by default, but receives HTTP 301 or 302, causing health checks to fail.
Comparing the expected response code with the actual response code isolates the cause of the health check failure.
4
Determine the resolution that allows health checks to succeed without changing the application's redirect logic.
Configure the target group's matcher settings to accept HTTP 301 or 302 codes as healthy.
This updates the load balancer's success criteria to align with the application's redirect behavior.

Anahtar Kavram

Handling application-level HTTP redirects in Application Load Balancer target group health checks
Bu soruyu puanla

Konular

Elastic Load Balancing Health Checks and Troubleshooting

Bu konudan daha fazla soru