Instance group target is unhealthy

When your target group shows instances as unhealthy even though the EC2 instances themselves are running, there are several potential causes to investigate:

1. Health Check Configuration Issues:

• Verify that the health check path is valid and returns the expected HTTP status code (200 by default)
• Your application might be returning a different status code than what's expected
• You may need to modify the acceptable status codes in your target group health check settings

2. Network Configuration Problems:

• Check that your VPC networking is correctly set up with proper routing between the load balancer and your EC2 instances
• Ensure security groups allow traffic on the application port (likely 80 or 443) from the load balancer's security group to your EC2 instance
• Both inbound and outbound rules should be properly configured

3. Application Configuration:

• Verify your application is listening on the correct port and interface (0.0.0.0 to listen on all interfaces, not just localhost)
• Ensure the application is configured to respond to the health check path
• Check if the application is fully started and running

4. Specific Health Check Troubleshooting:

• Check the reason code for the unhealthy status in the target group details
• Review application logs on your EC2 instance for health check requests
• Temporarily modify security groups to allow broader access for testing

Even though your instances are marked as unhealthy, the load balancer will still route traffic to them if all targets are unhealthy (fail-open mode). However, this is not ideal for production environments.

To resolve this issue, I recommend checking your security group configurations, verifying that your application is properly responding to health checks, and ensuring that network connectivity between the load balancer and your instances is working correctly.
Sources
My ALB target group shows my private EC2 as unhealthy, even though the app runs fine via SSH. Accessing it through the ALB DNS fails. What could be causing the health checks to fail? | AWS re:Post
ELB Target group is not able to make the private subnet EC2 as healthy | AWS re:Post

Hello.

In the image, the port number for the target group is 8084. Is this correct?
The health check will fail if the EC2 instance is not listening on port 8084.
Also, even if EC2 is listening, the health check will fail if port 8043 is not allowed in the security group set for EC2.