AWS ECS: Unhealthy containers

Question

In my AWS account, I have the following setup:

• 1x ECS cluster with 2 services (service-a and service-b)
• Each service has their own target group
• service-a binds the port on 443
• service-b binds the port on 8888 (I needed to do that, because 443 might be already allocated by service-a) Both services are reachable with HTTPS protocol
• 1x ALB which will be used in both service to load balance traffic
• 1x HTTPS Listener on the ALB (balances traffic by path)
• 1x Security group for the ALB (only allows inbound traffic from a given network)
• 1x Security group for all ECS EC2 Instances which are allowing inbound traffic from the ALB (on port 443 (HTTPS) and 8888 (Custom TCP Rule))

However:

service-b is always unhealthy.

I tried to add a new HTTPS Listener on the ALB which listens on port 8888 and this listener forwards the traffic to my service-b-target-group as expected.

Does anyone have any clue?

Thanks in advance!

Answer 1

Did you configure an advanced health check of your target group for service b?

it should look like this

The default setting of the target group is "traffic port". If you have configured an path-based routing, the traffic port is the same for both target groups.

Request on url.com:443/service-a and url.com:443/service-b will try to do health checks on port 443 on both target groups

For service-b you should define an advanced health check on a specific port, because your service listens on that port (8888 in your case)