Troubleshooting ECS ALB Health Check Failures
A company runs a website by using an Amazon Elastic Container Service (Amazon ECS) service that is connected to an Application Load Balancer (ALB). The service was in a steady state with tasks responding to requests successfully. A DevOps engineer updated the task definition with a new container image and deployed the new task definition to the service. The DevOps engineer noticed that the service is frequently stopping and starting new tasks because the ALB healtth checks are failing. What should the DevOps engineer do to troubleshoot the failed deployment?
Community Insight
This question tests the understanding of deployment timing; the trap is confusing security configurations with initialization latency, where increasing the grace period allows tasks to become healthy before checks begin.
Learn how to resolve Amazon ECS service instability caused by premature ALB health check failures during new task deployments using the health check grace period.
Candidates often choose A (Security Groups) assuming a connectivity issue, but since the service was previously stable, network rules are likely correct and the issue is purely timing-related.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is B because the scenario describes a transition from a steady state to instability upon updating the container image. New containers require time to start, initialize, and respond to health checks. If the Application Load Balancer (ALB) begins routing traffic or checking health before the application is ready, it marks the target as unhealthy, causing ECS to stop and restart the task in a loop. Increasing the ALB health check grace period tells the load balancer to ignore health check failures for a specified duration after the task registers, allowing the application sufficient time to warm up.Why the Other Options Are Wrong
Option A is incorrect because the service was already working in a steady state, implying that existing Security Group rules correctly allow traffic from the ALB. Changing security groups would not address the timing issue of a new image starting up. Option C affects the number of concurrent tasks but does not prevent the ALB from rejecting an individual task that hasn't finished initializing. Option D makes the health checks more frequent, which would likely exacerbate the problem by failing the check sooner if the app is still starting.Community Comment Notes
Community consensus strongly supports Option B. As user 'eugene2owl' noted, "A is wrong because... he could not affect security group" and the new Docker container takes longer to start, making the grace period the logical fix. User 'Ky_24' simply identified that "ALB health check is failing the new task," pointing directly to the need for a buffer period.Official Reference
Exam Strategy
Always distinguish between configuration errors (like Security Groups) and timing issues (like cold starts). If a system was previously stable and fails only after a code/container update, look for options that provide more time or handle initialization delays rather than changing network permissions.
Frequently Asked Questions
Why not increase minimum healthy percent?
Increasing minimum healthy percent controls the count of running tasks but doesn't stop the ALB from marking an unready task as unhealthy, which still triggers restarts.
Does this apply to EC2 Auto Scaling too?
Yes, the concept is identical; instances also need a grace period to initialize applications before ELB health checks can successfully verify them.
Related Analysis
Practice All DOP-C02 Questions
Access 85 questions with complete answers and detailed explanations.
View Full DOP-C02 Practice Test →