Create a check

Recommended first create

If you followed Create VPC and EC2, the lab instance listens on 8080 /health. Create the check excludedexcluded
Aggregation setting: the check runs and reports individual status but does not affect overall application status or Auto Scaling. from aggregationaggregation
Whether a check contributes to instance-level overall application status. included can drive Auto Scaling on impaired; excluded still reports per-check status. so it reports status without driving Auto Scaling. Use a short init graceinit grace
Seconds to wait after launch before the probe evaluates (default 300, max 600). Too short causes Auto Scaling thrash. so the lab is not stuck for five minutes.

ASC_ID=$(aws ec2 create-application-status-check \
  --protocol http \
  --port 8080 \
  --path "/health" \
  --status-code-matcher "200" \
  --aggregation excluded \
  --initialization-grace-period-seconds 60 \
  --query ApplicationStatusCheck.ApplicationStatusCheckId \
  --output text)
export ASC_ID
echo "$ASC_ID"

--port is 1–65535, not limited to 80 or 443. Match the process on the instance (8081, 8443, …). Protocol is only http or https. TCP, UDP, and gRPC are not supported. With an ALBALB
Application Load Balancer — steers traffic with its own target-group health checks. Complementary to application status checks, which decide whether the instance should exist., use the instance port, not the ALB listener.

HTTPS on a custom port (certificate is not validated):

aws ec2 create-application-status-check \
  --protocol https \
  --port 8443 \
  --path "/health" \
  --status-code-matcher "200" \
  --aggregation excluded

Note the ApplicationStatusCheckId (asc-...) in the response.

Note

Omitting --health-check-paths selects AWS-managed network pathsAWS-managed network paths
Default network path: omit --health-check-paths and AWS chooses the source subnet and security group for the managed ENI.. AWS chooses source and destination subnets and security groups.

Customer-managed network paths

Use customer-managed pathscustomer-managed paths
You pass --health-check-paths with source and destination subnet plus security group for the health-check ENI. when VPC segmentation, NACLs, or compliance require a specific source subnet and security group for the health-check ENI.

aws ec2 create-application-status-check \
  --protocol https \
  --port 8443 \
  --path "/health" \
  --status-code-matcher "200" \
  --aggregation excluded \
  --health-check-paths '[
    {
      "Source": {
        "SubnetId": "subnet-11111111111111111",
        "SecurityGroupId": "sg-aaaaaaaaaaaaaaaaa"
      },
      "Destinations": [
        {
          "SubnetId": "subnet-22222222222222222",
          "SecurityGroupId": "sg-bbbbbbbbbbbbbbbbb"
        }
      ]
    }
  ]'

Allow inbound on the destination group from sg-aaaaaaaaaaaaaaaaa on the same port as --port (here 8443).

Useful optional knobs

Parameter	Default	Notes
Protocol	required	http or https only
Port	required	1–65535 (any app port, not only 80/443)
Timeout	6 seconds	Range 1–30; must be less than the interval
FailureThreshold	2	Consecutive failures before failed
SuccessThreshold	2	Consecutive successes before passed
InitializationGracePeriodSeconds	300	1–600; too short causes ASG thrash
IpVersion	ipv4	Dual-stack needs a second check for IPv6
DeviceIndex	0	Change if the app is not on the primary ENI

The user guide documents the interval as 60 seconds and not configurable, even though the API exposes Interval. Treat 60 seconds as the SLA.

Inspect definitions and the managed source security group:

aws ec2 describe-application-status-checks \
  --application-status-check-ids "$ASC_ID"

Optional: tighten ingress to that source SG instead of the whole VPC CIDR.

Next

Associate the check with instance IDs or tags. Probes do not run until you associate.