A logistics Route 53 health check fails only because it targets a private address the public checkers cannot reach. The service also has a healthy public endpoint. What should the health check target?
Select an answer to reveal the explanation.
Short Explanation
You can think of it as knocking on a door inside a locked building while the party is waiting in the lobby. Since your health check runs from the public internet, point it at the public endpoint the checkers can reach rather than opening the private network just to satisfy the probe.
Full Explanation
Route 53 endpoint health checkers issue their requests from the public internet. A private address has no route from those checkers, so the check can fail even when the service is healthy inside the VPC. Because the service has a healthy public endpoint, the check should target that endpoint so its status reflects a path the checkers can actually use. Opening the VPC so public checkers can reach the private address exposes an internal path solely to satisfy the probe and is not needed. A private hosted zone name is answered only inside the logistics VPC, so public checkers cannot use it to reach the service. The instance metadata address is a link-local service available only from the instance, not a target the public checkers can contact. Exam caveat: a private hosted zone name does not become publicly reachable just because it identifies a healthy service; the checkers still need a usable public path. After retargeting the check, confirm that it becomes healthy and that it is observing the service’s public endpoint.