我如何才能找出我的健康检查失败的原因

Question

我的实例一直没有通过ELB健康检查，我找不到任何关于为什么会发生这种情况的信息。我转到控制台中的目标组，在"目标"下，我得到的唯一信息是健康检查状态为"不健康"，"健康状态详细信息"只显示"健康检查失败"。我如何才能找到我的健康检查失败的真正原因？这也是我的Terraform代码，其中包括我的负载均衡器、自动伸缩组、侦听器和目标组

main.tf

resource "aws_lb" "jira-alb" {
name               = "jira-alb"
internal           = false
load_balancer_type = "application"
security_groups    = [aws_security_group.jira_clb_sg.id]
subnets            = [var.public_subnet_ids[0], var.public_subnet_ids[1]]
enable_deletion_protection = false
access_logs {
bucket   = aws_s3_bucket.this.id
enabled  = true
}
tags = {
Environment = "production"
}

}
resource "aws_lb_target_group" "jira" {
name     = "jira-tg"
port     = 80
protocol = "HTTP"
vpc_id   = var.vpc_id
health_check {
enabled = true
healthy_threshold = 10
unhealthy_threshold = 5
interval = 30
timeout = 5
path = "/index.html"
}
stickiness {
type = "lb_cookie"
cookie_duration = 1 ## CANT BE 0.. RANGES FROM 1-604800
}
}
resource "aws_lb_listener" "jira-listener" {
port            = 443
protocol        = "HTTPS"
ssl_policy      = "ELBSecurityPolicy-TLS-1-2-2017-01"
load_balancer_arn = aws_lb.jira-alb.arn
certificate_arn = data.aws_acm_certificate.this.arn ##TODO Change to a variable
default_action {
type             = "forward"
target_group_arn = aws_lb_target_group.jira.arn
}
}
resource "aws_autoscaling_group" "this" {
vpc_zone_identifier       = var.subnet_ids
health_check_grace_period = 300
health_check_type         = "ELB"
force_delete              = true
desired_capacity          = 2
max_size                  = 2
min_size                  = 2
target_group_arns = [aws_lb_target_group.jira.arn]

timeouts {
delete = "15m"
}

launch_template {
id      = aws_launch_template.this.id
# version = "$Latest"
version = aws_launch_template.this.latest_version
}
instance_refresh {
strategy = "Rolling"
preferences {
min_healthy_percentage = 50
}
}
}

我本以为我的健康检查会通过，我的实例会继续运行，但它们一直失败，并被重新部署

这里还有我的负载均衡器和自动伸缩组的安全组

安全组.tf

resource "aws_security_group" "jira_clb_sg" {
description = "Allow-Veracode-approved-IPs from external to elb"
vpc_id      = var.vpc_id
tags = {
Name      = "public-elb-sg-for-jira"
Project   = "Jira Module"
ManagedBy = "terraform"
}
ingress {
from_port   = 443
to_port     = 443
protocol    = "tcp"
cidr_blocks = var.veracode_ips
}
egress {
from_port   = 0
to_port     = 0
protocol    = -1
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_security_group" "jira_sg" {
description = "Allow-Traffic-From-CLB"
vpc_id      = var.vpc_id
tags = {
Name      = "allow-jira-public-clb-sg"
Project   = "Jira Module"
ManagedBy = "terraform"
}
ingress {
from_port       = 0
to_port         = 0
protocol        = -1
security_groups = [aws_security_group.jira_clb_sg.id]
}
egress {
from_port   = 0
to_port     = 0
protocol    = -1
cidr_blocks = ["0.0.0.0/0"]
}

}

我的负载平衡器允许来自端口443的流量，我的自动缩放组允许来自负载平衡器安全组的任何端口上的流量

Answer 1

您的健康检查在端口80上，您的安全组只打开端口443。

如官方文件中所述

"您必须确保您的负载平衡器可以在侦听器端口和运行状况检查端口上与注册的目标进行通信。每当您向负载平衡器添加侦听器或更新负载平衡器用于路由请求的目标组的运行状况检查口时，您必须验证与负载均衡器相关联的安全组是否允许新端口上双向的流量"；