What's the easiest way of enabling ECS health checks that are on different port than traffic port?

To enable health checks in ECS/ELB that are on a different port than the main traffic port, you have a couple of options:

1. Port Override: You can use a port override feature to specify a different port for health checks while maintaining the original port for traffic. This allows you to configure the health check to use a specific port that's different from the main traffic port.

2. Separate Health Check Endpoint: You can create a separate health check endpoint in your application that listens on a different port. Then, configure your ECS task definition to expose this port, and set up the load balancer to use this specific port for health checks.

When implementing this in Terraform, you would need to:

1. Define the task definition with both the main traffic port and the health check port exposed.

2. Configure the load balancer (ALB or NLB) to use the specific health check port.

3. Ensure that the security groups allow traffic on both the main port and the health check port.

It's important to note that when you specify a port override for health checks, the health check will continue to use the original port, not the override port. This behavior maintains consistency across different types of endpoints like Network Load Balancers, Application Load Balancers, EC2 instances, and Elastic IP addresses.

Remember to adjust your security group settings to allow traffic on the health check port. For example, if your main traffic is on port 443 and you're using port 8080 for health checks, make sure your security group allows inbound traffic on port 8080 for the health check to function properly.

While this approach allows for flexibility in your health check configuration, it's crucial to carefully manage your port mappings and security settings to ensure proper functionality and security of your ECS services.
Sources
Override listener ports for restricted ports or connection collisions - AWS Global Accelerator
Reach ECS service on unmapped port | AWS re:Post

Option1:

"portMappings": [ { "containerPort": 8080, // Application port "hostPort": 80 // Traffic port }, { "containerPort": 8081, // Health check port "hostPort": 8081 // Health check port } ] Then configure the health check to use port 8081 in your task definition.

Option2:

Using Docker HEALTHCHECK: Add a HEALTHCHECK instruction in your Dockerfile:

HEALTHCHECK --interval=30s --timeout=5s
CMD curl -f http://localhost:8081/health || exit 1

The first approach is generally recommended because:

It's more explicit and easier to manage
Provides better integration with ECS health checks
Allows easier debugging and monitoring
Doesn't require modifying the Dockerfile

Remember to ensure your security groups allow traffic on the health check por