Q: Your ALB target group is showing all instances as unhealthy. What do you check?
1. Health check path — does the path exist? curl http://<instance-ip>:<health-check-port><health-check-path> from the ALB's subnet.
#AWS #Networking & VPC #L2 #Cloud #Infrastructure #ALB
🎙️ Candidate Opening & Architectural Context
""AWS reliability requires differentiating between AWS control plane limits and host-level resource exhaustion. When addressing this question, I walk the interviewer through our production incident runbook: isolating the blast radius, checking diagnostic logs and metrics, and applying a safe fix.""
Advertisement
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Initial Diagnostics & Root Cause Analysis
- Health check path — does the path exist?
curl http://from the ALB's subnet.: - Security group — the ALB's Security Group must be allowed to reach the instance on the health check port. Add inbound rule to instance SG: allow from ALB SG.
- Instance running the app — is the application actually running on that port?
netstat -tlnp | grep.
2️⃣
Remediation & Permanent Safeguards
## 🟡 IAM & Security
- Health check port — is it the traffic port or a different one? Misconfiguration here is common.
- Response code — the health check expects 200. If the app returns 301 redirect, that's a failure by default. Add 301 to success codes or fix the redirect.
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: Health check path — does the path exist? curl http://: from the ALB's subnet.."
⚡ 60-Second Elevator Pitch Talking Points
- Health check path — does the path exist? curl http://: from the ALB's subnet.
- Security group — the ALB's Security Group must be allowed to reach the instance on the health che...
- Instance running the app — is the application actually running on that port? netstat -tlnp | grep .
Advertisement