Skip to main content

​
Triage and Remediation

  • Remediation

​
Remediation

Using Console

To remediate the misconfiguration “Right Health Check Configurations Should Be Used For App-Tier ELBs” for AWS using AWS console, follow these steps:
  1. Open the AWS Management Console and navigate to the EC2 dashboard.
  2. Click on the “Load Balancers” option in the left-hand menu.
  3. Select the Application Load Balancer that you want to remediate.
  4. In the “Listeners” tab, click on the “View/edit rules” button for the listener that you want to remediate.
  5. In the “Rules” section, click on the “Edit” button for the rule that you want to remediate.
  6. In the “Edit Rule” dialog box, click on the “Add Condition” button.
  7. In the “Add Condition” dialog box, select “Health Check” from the drop-down menu and configure the health check settings as per your requirements.
  8. Click on the “Save” button to save the changes.
  9. Repeat steps 5-8 for all the rules that you want to remediate.
  10. Once you have remediated all the rules, click on the “Save” button in the “Listeners” tab to save the changes.
By following these steps, you can remediate the misconfiguration “Right Health Check Configurations Should Be Used For App-Tier ELBs” for AWS using AWS console.

​

To remediate the misconfiguration “Right Health Check Configurations Should Be Used For App-Tier ELBs” for AWS using AWS CLI, follow these steps:
  1. Open the AWS CLI and run the following command to describe the load balancer:
aws elb describe-load-balancers --load-balancer-name <load_balancer_name>
Note: Replace <load_balancer_name> with the name of your load balancer.
  1. Check the health check configuration of the load balancer. The health check configuration includes the ping target, port, and timeout settings. To view the health check configuration, run the following command:
aws elb describe-instance-health --load-balancer-name <load_balancer_name>
  1. If the health check configuration is incorrect, update it by running the following command:
aws elb configure-health-check --load-balancer-name <load_balancer_name> --health-check Target=HTTP:80/index.html,Interval=30,UnhealthyThreshold=2,HealthyThreshold=2,Timeout=3
Note: Replace <load_balancer_name> with the name of your load balancer. You can modify the health check configuration as per your requirement.
  1. After updating the health check configuration, verify it by running the following command:
aws elb describe-instance-health --load-balancer-name <load_balancer_name>
This will ensure that the right health check configurations are used for the app-tier ELBs in AWS.
To remediate the misconfiguration “Right Health Check Configurations Should Be Used For App-Tier ELBs” in AWS using Python, you can follow these steps:
  1. Import the necessary libraries: boto3 and json.
import boto3
import json
  1. Create a connection to the AWS resource using the boto3 library.
elbv2 = boto3.client('elbv2')
  1. Get all the load balancers in the region.
response = elbv2.describe_load_balancers()
  1. Loop through the load balancers and check if they are application load balancers.
for lb in response['LoadBalancers']:
    if lb['Type'] == 'application':
  1. If the load balancer is an application load balancer, get its ARN.
arn = lb['LoadBalancerArn']
  1. Get the current health check configuration for the load balancer.
health_check = elbv2.describe_target_group_health(TargetGroupArn=arn)
  1. Check if the health check configuration is correct.
if health_check['HealthChecks'][0]['IntervalSeconds'] != 30 or health_check['HealthChecks'][0]['TimeoutSeconds'] != 5 or health_check['HealthChecks'][0]['HealthyThresholdCount'] != 5 or health_check['HealthChecks'][0]['UnhealthyThresholdCount'] != 2:
  1. If the health check configuration is incorrect, update it to the correct configuration.
elbv2.modify_target_group_attributes(
    TargetGroupArn=arn,
    Attributes=[
        {
            'Key': 'deregistration_delay.timeout_seconds',
            'Value': '30'
        },
        {
            'Key': 'health_check.interval_seconds',
            'Value': '30'
        },
        {
            'Key': 'health_check.timeout_seconds',
            'Value': '5'
        },
        {
            'Key': 'health_check.healthy_threshold_count',
            'Value': '5'
        },
        {
            'Key': 'health_check.unhealthy_threshold_count',
            'Value': '2'
        },
    ]
)
  1. Print a message to confirm that the health check configuration has been updated.
print(f"Health check configuration updated for load balancer {lb['LoadBalancerName']}")
  1. The final code will look like this:
import boto3
import json

elbv2 = boto3.client('elbv2')

response = elbv2.describe_load_balancers()

for lb in response['LoadBalancers']:
    if lb['Type'] == 'application':
        arn = lb['LoadBalancerArn']
        health_check = elbv2.describe_target_group_health(TargetGroupArn=arn)

        if health_check['HealthChecks'][0]['IntervalSeconds'] != 30 or health_check['HealthChecks'][0]['TimeoutSeconds'] != 5 or health_check['HealthChecks'][0]['HealthyThresholdCount'] != 5 or health_check['HealthChecks'][0]['UnhealthyThresholdCount'] != 2:
            elbv2.modify_target_group_attributes(
                TargetGroupArn=arn,
                Attributes=[
                    {
                        'Key': 'deregistration_delay.timeout_seconds',
                        'Value': '30'
                    },
                    {
                        'Key': 'health_check.interval_seconds',
                        'Value': '30'
                    },
                    {
                        'Key': 'health_check.timeout_seconds',
                        'Value': '5'
                    },
                    {
                        'Key': 'health_check.healthy_threshold_count',
                        'Value': '5'
                    },
                    {
                        'Key': 'health_check.unhealthy_threshold_count',
                        'Value': '2'
                    },
                ]
            )
            print(f"Health check configuration updated for load balancer {lb['LoadBalancerName']}")
⌘I