Fix AWS ALB Health Check Failed for Target Group

Your Load Balancer Health Check Keeps Failing — Here's the Fix

It's frustrating when you've set up an Application Load Balancer, but every target shows as "unhealthy." You refresh the page, you double-check the instances are running, and still — nothing. I've seen this exact issue dozens of times. Usually the fix is simple. Let's get your health checks passing.

Step 1: Verify the Ping Path

The most common reason health checks fail is a wrong ping path. By default, AWS sets the ping path to /. But your application might not respond on that path. Here's what to do:

1. Open the EC2 console, go to Target Groups, and select your target group.
2. Go to the Health checks tab. Look at the Ping path field.
3. Compare it to a path your application actually responds to. For example, if you're running an API, it might be /health or /status. For a web app, try /index.html or just / if it returns a 200.
4. Change the ping path to something you know returns a 200 or 301 status code.
5. Click Save. You should see the health check change to "healthy" within a few seconds — usually within one or two health check intervals (default is 30 seconds).

Step 2: Check Security Group Rules

If the ping path is right and you still see unhealthy targets, the next culprit is the security group on your targets. The ALB needs to be able to reach your instances on the health check port. Here's the fix:

1. Go to the Security Groups section in the EC2 console.
2. Find the security group attached to your target instances (usually the same one you assigned when launching them).
3. Check the Inbound rules. You need a rule that allows traffic from the ALB's security group on the health check port (default is 80 or 443). The source should be the security group ID of your load balancer, not 0.0.0.0/0.
4. If that rule is missing, add it. For example: Type: HTTP, Port: 80, Source: sg-xxxxxxxxxxxx (the ALB's security group ID).
5. Click Save rules. After adding the rule, the health check should pass within a few seconds.

Step 3: Check Target Group Port and Protocol

Sometimes the health check is failing because the port or protocol in the target group doesn't match what your application is listening on. Here's how to verify:

1. Back in your target group's Group details tab, look at the Port and Protocol fields.
2. If your application is running on port 3000, but the target group has port 80, the health check will fail every time. Change the port to match your application's port.
3. Also check the protocol. If your app is HTTP, set it to HTTP. If it's HTTPS, set it to HTTPS. Don't mix them — it won't work.
4. Click Save. After saving, your targets should come back healthy.

Why This Works

The ALB works by sending a GET request to your targets on the health check port at the ping path. If the target responds with a status code in the 200-399 range, the health check passes. If it responds with a 4xx or 5xx, or doesn't respond at all, it fails. Security groups control which traffic can reach your instances. Without a rule allowing the ALB's traffic, the health check request gets dropped at the network level, and the target never sees it. And if the ping path doesn't match your application's routes, your app sends back a 404 or 500, which the ALB treats as a failed health check. All three of these steps address those specific failure points.

Less Common Variations

Health Check Timeout Too Short

If your application is slow — maybe it's a Node.js app that takes 10 seconds to start responding — the default 5-second timeout can cause failures. In your target group's health check settings, increase the Timeout to 10 or 15 seconds. Also increase the Interval to 60 seconds to give your app more breathing room. I've fixed several WordPress sites this way.

SSL/TLS Certificate Mismatch

If you're using HTTPS health checks and your target has a self-signed certificate, the ALB will fail the health check because it can't verify the certificate. The real fix is to switch to HTTP for health checks (not for the actual app traffic — just the health check). In the target group settings, change the health check protocol to HTTP. The ALB doesn't care about encryption for health checks.

Network ACLs Blocking Traffic

If your security groups look fine but health checks still fail, check the Network ACLs (NACLs) on your subnets. NACLs are stateless, so you need both inbound and outbound rules. The inbound rule must allow traffic from the ALB's subnets, and the outbound rule must allow the response back. If you've got a NACL that's locked down too tight, it can silently drop health check traffic.

Targets Not Passing Health Check on the Wrong Port

If your application is listening on multiple ports, make sure the health check is hitting the same port your app is using. I've seen people set the target group to port 443 but their app only listens on port 80. The ALB's health check connects to port 443, gets no response, and marks it unhealthy.

How to Prevent This

Here's my advice: before you even set up the target group, test the health check URL manually on your instance. Curl it from the command line. For example:

curl -I http://localhost:80/health

If that returns a 200, you're golden. If it returns a 404 or 500, fix your app first. Also, always tag your security groups with names like "alb-sg" and "web-sg" so you can easily identify which one is which when you're adding rules. And when you launch a new target, double-check the port it's listening on before you add it to the target group. These small checks will save you from that first health check failure every time.