Auto Scaling group uses ELB health checks

Check ID: autoscaling_group_elb_health_check_enabled
Provider: AWS
Service: autoscaling
Severity: LOW
Categories: resilience
Resource type: AwsAutoScalingAutoScalingGroup

What this check verifies

EC2 Auto Scaling groups attached to a load balancer are evaluated for ELB-based health checks that use the load balancer’s target health instead of instance-only checks.

Risk

Without ELB health checks, the group may keep instances that fail load balancer probes, causing:

Reduced availability from routing to bad targets
Higher error rates impacting transaction integrity
Inefficient scaling and increased costs

Recommendation

Enable ELB health checks for Auto Scaling groups behind load balancers to reflect real client reachability. Apply high availability and defense in depth by:

Using application-appropriate LB probes
Tuning grace and threshold settings to avoid flapping
Monitoring health metrics and alerts

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws autoscaling update-auto-scaling-group —auto-scaling-group-name <auto-scaling-group-name> —health-check-type ELB

# Enable ELB health checks on the Auto Scaling group
resource "aws_autoscaling_group" "<example_resource_name>" {
  health_check_type = "ELB"  # Remediation: ensures ASG uses load balancer health status
}

# CloudFormation: Enable ELB health checks for the Auto Scaling group
Resources:
  <example_resource_name>:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      HealthCheckType: ELB  # Remediation: use ELB health checks so the ASG evaluates instance health via the load balancer

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = autoscaling_group_elb_health_check_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

EC2 Auto Scaling group has Capacity Rebalancing enabled Auto Scaling launch config assigns no public IP

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires