Check ID: elasticbeanstalk_environment_enhanced_health_reporting
Provider: AWS
Service: elasticbeanstalk
Severity: LOW
Categories: logging
Resource type: AwsElasticBeanstalkEnvironment

What this check verifies

Elastic Beanstalk environments have health reporting set to enhanced instead of basic.

Risk

Without enhanced health, issues are detected late, raising MTTR and enabling service outages. Hidden instance failures or bad deployments can create uneven fleets, degrading availability and potentially integrity (serving stale versions), while error spikes and thrash increase operational cost.

Recommendation

Set health reporting to enhanced for all environments and make it a security baseline. Connect health signals to alerts for rapid response. Apply least privilege to required roles and use defense in depth with auto-healing, alarms, and runbooks to prevent prolonged degradation.

Remediation

aws elasticbeanstalk update-environment --environment-name <environment-name> --option-settings Namespace=aws:elasticbeanstalk:healthreporting:system,OptionName=SystemType,Value=enhanced

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elasticbeanstalk_environment_enhanced_health_reporting. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks