Rule: Auto Scaling groups with a load balancer should use health checks
This rule specifies that Auto Scaling groups with load balancers must implement health checks for optimal performance.
| Rule | Auto Scaling groups with a load balancer should use health checks |
| Framework | NIST Cybersecurity Framework (CSF) v1.1 |
| Severity | ✔ Critical |
Rule Description: Auto Scaling groups with a load balancer should use health checks for NIST Cybersecurity Framework (CSF) v1
Rule Summary
This rule requires that all Auto Scaling groups utilizing a load balancer should have health checks implemented, in accordance with the NIST Cybersecurity Framework (CSF) version 1.
Why is this important?
By implementing health checks for Auto Scaling groups with load balancers, you ensure that instances within the group are regularly monitored for their health status. Health checks enable the load balancer to detect unhealthy instances and remove them from the pool of available resources. This improves the overall availability and reliability of your application or service.
Troubleshooting Steps
If you encounter issues related to the health checks for your Auto Scaling groups with load balancers, follow these troubleshooting steps:
- 1.Check load balancer configuration: Ensure that the load balancer and Auto Scaling group are properly configured and associated with each other. Validate that the load balancer is correctly registered with the Auto Scaling group.
- 2.Verify health check settings: Confirm that the health check settings for the load balancer are correctly configured. Ensure that the target group or the instances are selected as the health check targets.
- 3.Review instance health: Check the health of each instance within the Auto Scaling group. Identify any instances that are marked as unhealthy and investigate the underlying issues.
- 4.Check security group rules: Ensure that the security group associated with the instances and load balancer allows the necessary traffic for health checks. Verify that the appropriate inbound rules are in place.
- 5.Review logs and monitoring: Review the logs and monitoring metrics provided by your cloud provider to identify any anomalies or errors related to health checks. Analyze the log entries and metrics to troubleshoot the problem.
If these steps do not resolve the issue, further investigation or contacting your cloud provider's support may be necessary.
Necessary Code
If you need to implement health checks for your Auto Scaling groups with load balancers, you can use the following AWS CLI commands:
- 1.To create a health check for a target group:
aws elbv2 create-target-group \ --name <target-group-name> \ --protocol <protocol> \ --port <port> \ --vpc-id <vpc-id> \ --health-check-protocol <health-check-protocol> \ --health-check-port <health-check-port> \ --health-check-path <health-check-path> \ --healthy-threshold-count <healthy-threshold-count> \ --unhealthy-threshold-count <unhealthy-threshold-count> \ --timeout-seconds <timeout-seconds> \ --interval-seconds <interval-seconds> \ --matcher <matcher>
- 1.To associate an Auto Scaling group with a target group:
aws autoscaling attach-load-balancer-target-groups \ --auto-scaling-group-name <auto-scaling-group-name> \ --target-group-arns <target-group-arns>
Make sure to replace the placeholders (e.g.,
<target-group-name><protocol><port>Step-by-Step Guide for Remediation
Follow these steps to implement health checks for your Auto Scaling groups with load balancers:
- 1.Create a Target Group:
- Use the AWS CLI command mentioned above to create a target group for your load balancer.
- 2.Configure Health Check Settings:
- Specify the appropriate health check protocol, port, path, thresholds, timeout, interval, and matcher while creating the target group. Ensure these settings align with your application's requirements.
- 3.Associate Target Group with Auto Scaling Group:
- Use the AWS CLI command mentioned above to associate the target group with your Auto Scaling group. This will enable health checks for instances in the group.
- 4.Verify Health Check Status:
- Monitor the health checks status for each instance within the Auto Scaling group. Ensure that instances are marked as healthy and are responding correctly to health checks.
- 5.Review and Troubleshoot:
- Analyze logs, monitor metrics, and review any health check-related issues or errors. Use the troubleshooting steps mentioned earlier to resolve any identified problems.
By following these steps, you will successfully implement health checks for your Auto Scaling groups with load balancers as per the NIST Cybersecurity Framework (CSF) version 1 requirements.