Check ID:
Provider: AWS
Service:
Severity: LOW
Categories:
Resource type:
elasticbeanstalk_environment_enhanced_health_reportingProvider: AWS
Service:
elasticbeanstalkSeverity: LOW
Categories:
loggingResource type:
AwsElasticBeanstalkEnvironmentWhat this check verifies
Elastic Beanstalk environments have health reporting set toenhanced instead of basic.
Risk
Without enhanced health, issues are detected late, raising MTTR and enabling service outages. Hidden instance failures or bad deployments can create uneven fleets, degrading availability and potentially integrity (serving stale versions), while error spikes and thrash increase operational cost.Recommendation
Set health reporting toenhanced for all environments and make it a security baseline. Connect health signals to alerts for rapid response. Apply least privilege to required roles and use defense in depth with auto-healing, alarms, and runbooks to prevent prolonged degradation.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/health-enhanced-enable.html#health-enhanced-enable-console
- https://docs.aws.amazon.com/securityhub/latest/userguide/elasticbeanstalk-controls.html#elasticbeanstalk-1
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = elasticbeanstalk_environment_enhanced_health_reporting. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks