Load balancer : 502 bad gateway

Question

Hi Everyone,

I'm a french developper (sorry for my english mistakes), beginner in AWS hosting.

Currently, i'm developping an API. It works fine in http but i've a 502 Bad Gateway in https.

My environment is architectured like this :
- A load balancer with a target group and two listeners (http and https). The https target group take https packets and forward theses packets in http to an EC2 instance. The target group has a health status in green state (Healthy).
- An unique EC2 instance (for this moment)

I've created a S3 container in order to store logs about load balancer access. The elb_status_code is "502" and the target_status_code is "-", then my load balancer is the source of the HTTP 502 errors.

Something is missing in my load balancer configuration but i've no idea about the solution :-(
If somenone has an idea to find a solution about this issue, it would be nice :-)

Regards,
Stephane

Accepted Answer

502 is usually from the EC2 instance sending the ALB (application load balancer) an unexpected response: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html#http-502-issues

What port is the target group set to send traffic to the instance on?  Since the ALB is sending HTTP traffic to the backend, you should be sending it on port 80.  If your target group is sending HTTP traffic to the instance on port 443, the instance will reply with a TCP RST response, since the webserver would be expecting HTTPS requests on port 443

In fact, you can use the same target group for both your HTTP and HTTPS listeners, since the traffic going to the backend EC2 instance is the same for both

Answer

Health check and target configuration I am target group can be setup different from each other.

You can have a http health check and try and forward packets to http port using ssl. This will work and error.

Ensure your traffic port in the target group is by the sounds of it http only.

Answer

Hello,

i hope you are already offloading your the TLS connection at ALB and then create a target group pointing to port 80 on the instance(s), and then set the default rule on the HTTPS listener to send traffic to that target group.

Follow below link to make sure your settings are correct.
 https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html:

for 502 Possible causes could be :

The load balancer received a TCP RST from the target when attempting to establish a connection.

The load balancer received an unexpected response from the target, such as "ICMP Destination unreachable (Host unreachable)", when attempting to establish a connection. Check whether traffic is allowed from the load balancer subnets to the targets on the target port.

The target closed the connection with a TCP RST or a TCP FIN while the load balancer had an outstanding request to the target. Check whether the keep-alive duration of the target is shorter than the idle timeout value of the load balancer.

The target response is malformed or contains HTTP headers that are not valid.

The target response header exceeded 32 K for the entire response header.

The deregistration delay period elapsed for a request being handled by a target that was deregistered. Increase the delay period so that lengthy operations can complete.

The target is a Lambda function and the response body exceeds 1 MB.

The target is a Lambda function that did not respond before its configured timeout was reached.

The target is a Lambda function that returned an error or the function was throttled by the Lambda service.

you can check below link for troubleshooting.

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-troubleshooting.html#http-502-issues

Load balancer : 502 bad gateway

Relevant content