What are application status checks?

What shipped

On 10 August 2026 Amazon EC2 added application status checksapplication status checks
Opt-in EC2 HTTP or HTTPS probe (every 60 seconds, HTTP/2) from a managed ENI in your VPC. Reports next to system, instance, and attached EBS status checks. Port is 1–65535, not only 80/443.: an opt-in HTTP or HTTPS probe that reports next to the existing system, instance, and attached EBS checks.

You define protocol, port, path, and healthy response codes. Port is any TCP port 1–65535 (8080, 8081, 8443, not only 80/443). Protocol is HTTP or HTTPS only. You associate the check with instances by instance ID or tag. EC2 then sends a request every 60 seconds from a managed ENImanaged ENI
AWS-created elastic network interface that originates health-check traffic. One per source subnet × source security group. Counts against ENIs per VPC, not per-instance ENI limits. in your VPC and records pass or fail.

If the overall application statusoverall application status
Instance-level application status from included checks: ok, impaired, initializing, insufficient-data, not-applicable, or suppressed. Auto Scaling acts only on impaired. is impaired and the check is includedincluded
Default aggregation setting: the check contributes to overall application status. impaired overall status can replace Auto Scaling instances. in aggregationaggregation
Whether a check contributes to instance-level overall application status. included can drive Auto Scaling on impaired; excluded still reports per-check status., Amazon EC2 Auto ScalingAmazon EC2 Auto Scaling
Amazon EC2 Auto Scaling. With aggregation included, the group replaces instances whose overall application status is impaired — no extra HealthCheckType. replaces the instance. You do not set a new Auto Scaling health-check type.

How a probe runs

1. AWS creates one managed ENI per combination of source subnet and source security group that has associated instances.
2. Health-check traffic originates from AWS-managed instances in the same Availability Zone as the target (parent AZ for Local Zones).
3. The request uses HTTP/2HTTP/2
   HTTP/2 — the protocol the probe uses. HTTP/1.1-only listeners often fail even when curl over HTTP/1.1 succeeds. HTTPS probes do not validate certificates and do not follow redirects.. HTTPS does not validate the server certificate. Redirects are not followed.
4. Consecutive failures (FailureThreshold, default 2) mark the check failed. Consecutive successes (SuccessThreshold, default 2) mark it healthy again.

Caution

New checks default to aggregation=included. Associate that with an Auto Scaling group and the first failed probe can replace instances before you have seen a reason code. This walkthrough creates the check as excludedexcluded
Aggregation setting: the check runs and reports individual status but does not affect overall application status or Auto Scaling. so status still reports, but Auto Scaling does not act. Flip to included after the fail and pass cycle looks right.

Status values

Each associated check reports passed, failed, initializing, insufficient-data, or not-applicable.

Overall application status for the instance is:

Status	Meaning
ok	All included checks passed
impaired	One or more included checks failed — Auto Scaling replaces
initializing	First evaluation not finished
insufficient-data	Not enough data yet
not-applicable	All associated checks are excluded. Console: None associated or included
suppressed	You paused evaluationYou paused evaluation Pause evaluation on an instance for a duration so deploys and reboots do not look impaired. for maintenance

Auto Scaling acts only on impaired. It ignores the other overall values.

Protocol, port, and ALB

The check is an HTTP client, not a TCP/UDP/gRPC probe and not a process inspector. Anything that answers HTTP/2 GET on the configured port and path can be a target — nginx, Tomcat, a sidecar on 8081, TLS on 8443.

Knob	Allowed	Not allowed
Protocol	http, https	TCP, UDP, TLS-only, gRPC
Port	1–65535 (8080, 8081, 8443, 80, …)	—
Path	GET starting with / (default /)	Authenticated or redirect-only apps
Transport	HTTP/2	HTTP/1.1-only listeners often fail

You do not need an ALBALB
Application Load Balancer — steers traffic with its own target-group health checks. Complementary to application status checks, which decide whether the instance should exist.. The probe reaches the instance from inside the VPC.

If you already have one, keep its health checks for who receives traffic. Use this check for whether the instance should still exist. Point it at the instance port, not the load balancer hostname. Example: the ALB listens on 443 and forwards to :8081 on the instance — create the check with --protocol http --port 8081.

HTTPS probes skip certificate validation. They do not follow redirects.

What it cannot see

It does not inspect processes or containers. A stopped Docker daemon, a hung worker, or a dead sidecar is invisible unless that failure shows up as a bad HTTP response on the port and path you configured.

Next

Probe path shows the managed ENI and overall status. Then Prerequisites and Create VPC and EC2.