Probe path

AWS (same AZ)
    └── managed ENI in your VPC
            └── HTTP/2 GET  :<port>/path   (any 1–65535, e.g. 8080 or 8443)
                    └── instance ENI (device index 0)
                            └── app returns 200  →  passed
                            └── timeout / 5xx    →  failed

Instance overall status (included checks only)
    ok | impaired | initializing | insufficient-data | not-applicable | suppressed
            │
            └── impaired + aggregation=included
                    └── Auto Scaling terminate + launch

Network

Health-check traffic originates from AWS-managed instances in the same Availability Zone as the target (parent AZ for Local Zones). It stays on the AWS internal network. It does not traverse the public internet.

AWS creates one managed ENImanaged ENI
AWS-created elastic network interface that originates health-check traffic. One per source subnet × source security group. Counts against ENIs per VPC, not per-instance ENI limits. per (source subnet × source security group) that has associated instances. That ENI does not count against per-instance ENI limits; it does count against ENIs per VPC.

Note

Protocol is HTTP or HTTPS only. Port is 1–65535 — not limited to 80/443. HTTPS probes do not validate the server certificate. Redirects are not followed. Requests use HTTP/2HTTP/2
HTTP/2 — the protocol the probe uses. HTTP/1.1-only listeners often fail even when curl over HTTP/1.1 succeeds. HTTPS probes do not validate certificates and do not follow redirects..

AWS-managed vs customer-managed paths

Mode	Who picks source subnet and SG
AWS-managedAWS-managed Default network path: omit --health-check-paths and AWS chooses the source subnet and security group for the managed ENI. (omit --health-check-paths)	AWS
Customer-managedCustomer-managed You pass --health-check-paths with source and destination subnet plus security group for the health-check ENI. (pass --health-check-paths)	You

Use customer-managed paths when NACLs, inspection, or segmentation restrict who may reach the app port.

Aggregation

Setting	Individual status	Overall status	Auto Scaling
includedincluded Default aggregation setting: the check contributes to overall application status. impaired overall status can replace Auto Scaling instances. (default)	Yes	Contributes	Replaces on impaired
excludedexcluded Aggregation setting: the check runs and reports individual status but does not affect overall application status or Auto Scaling.	Yes	Ignored	No

This walkthrough creates checks as excluded, verifies, then flips to included only if you want replacements.

Next

Prerequisites, then Create VPC and EC2.