ALB Target Group All Targets Unhealthy After ECS Deploy

The Problem

Deployed a new ECS service. ALB showed all targets as unhealthy. Getting 502s from the load balancer. ECS tasks were running fine.

What Happened

Two things were wrong simultaneously:

1. Health check path was / but the new service returns 404 on root — only /api/health returns 200
2. ECS task security group was blocking port 8080 from the ALB security group

The old service had the same issues but worked because it was running on port 80 (default) and returned 200 on /.

The Fix

Fix 1: Update health check path

aws elbv2 modify-target-group \
  --target-group-arn arn:aws:elasticloadbalancing:... \
  --health-check-path /api/health \
  --health-check-port 8080

Fix 2: Security group rule

# Get ALB security group
ALB_SG=$(aws elbv2 describe-load-balancers \
  --names my-alb \
  --query 'LoadBalancers[0].SecurityGroups[0]' --output text)
 
# Allow ALB to reach ECS tasks on port 8080
aws ec2 authorize-security-group-ingress \
  --group-id sg-ecs-tasks \
  --protocol tcp \
  --port 8080 \
  --source-group $ALB_SG

After both changes, targets became healthy within 30 seconds.

Root Cause

When changing application port from 80 to 8080, I updated the ECS container port but forgot to:

1. Update the ALB health check path for the new API
2. Update the security group to allow the new port

Checklist I now follow for port changes: ECS container port → Target group port → Health check path → Security group rule.