Readers of a news site connect through an Application Load Balancer, but the Route 53 health check targets one instance IP. The check stayed healthy while the load balancer failed. What should they change?

Route 53 reports the health of the endpoint its check targets. A check on one instance IP can succeed while the Application Load Balancer listener, security group, or target routing—the path readers actually use—has failed. Point the health check at the load balancer endpoint readers use so the check observes that path. Lowering the record TTL only changes how long resolvers cache an answer; it does not make the health check detect a load balancer failure. Adding a check for the instance’s private IP does not test the public reader path, and Route 53’s public health checkers cannot reach into the VPC to test that private address. Moving the public DNS record to the instance removes the load balancer from the reader path and still relies on one machine as the health signal. Exam caveat: a health check reports the condition of its target, not necessarily every aspect of the reader experience, so choose the endpoint that represents the path you need to monitor. Practical check: in a test, impair only the load balancer path and confirm that the Route 53 health check changes even while the instance IP remains healthy.