A target receives traffic after it passes one health check. It is taken out after UnhealthyThresholdCount consecutive failures (default 2) and put back after HealthyThresholdCount successes (default 5). The load balancer closes idle connections after 60 seconds by default, so targets must keep connections open longer than that.

Health check settings (target group)

Setting	Range	Default
`HealthCheckProtocol`	HTTP, HTTPS (GET)	HTTP
`HealthCheckPort`	port or `traffic-port`	the traffic port
`HealthCheckPath`	URI; gRPC `/package.service/method`	`/`; gRPC `/AWS.ALB/healthcheck`
`HealthCheckTimeoutSeconds`	2–120	5 (instance/ip), 30 (lambda)
`HealthCheckIntervalSeconds`	5–300	30 (instance/ip), 35 (lambda)
`HealthyThresholdCount`	2–10	5
`UnhealthyThresholdCount`	2–10	2
`Matcher`	HTTP 200–499 (lists or ranges); gRPC 0–99	`200`; gRPC `12`

aws elbv2 modify-target-group --target-group-arn <tg> \
  --health-check-path /healthz --matcher HttpCode=200-399 \
  --health-check-interval-seconds 15 --healthy-threshold-count 2

What the request looks like:

Host: is the target's private IP, plus :port when the port isn't the default. Apps that route by host name, or redirect unknown hosts, fail the check: give the health path a default virtual host.
User-Agent: ELB-HealthChecker/2.0.
WebSockets aren't supported for health checks.

Time to become healthy is roughly HealthyThresholdCount × HealthCheckIntervalSeconds once it starts passing (with defaults: 5 × 30 s). Container platforms with short start-up grace periods can kill tasks before then (UNVERIFIED arithmetic; the page states the thresholds, not the total).

States

initial → healthy / unhealthy. A target is unused when it is not registered, not used by a listener rule, in an AZ the load balancer doesn't have enabled, or stopped. Deregistering targets are draining, and unavailable means checks are disabled. Reason codes are in reference/elb/errors.md.

Fail-open: if every target in the group is unhealthy, the load balancer routes to all of them. Deregistering a target lowers HealthyHostCount without raising UnhealthyHostCount.

Health check logs can be written to S3 for detailed diagnosis.

Load balancer attributes

Attribute key	Range	Default	Why it matters
`idle_timeout.timeout_seconds`	1–4000	60	Connections idle this long are closed. Long uploads need ≥1 byte per interval. Set the target's keep-alive longer than this, or you get intermittent 502s. HTTP/2 PING frames don't reset it
`client_keep_alive.seconds`	60–604800	3600	Maximum life of a client connection. Then the load balancer sends `Connection: close` (HTTP/1.x) or GOAWAY (HTTP/2). Lower it for faster recovery after zonal shifts
`routing.http.desync_mitigation_mode`	monitor, defensive, strictest	defensive	How non-RFC 7230 requests are treated. Severe requests get 400 in defensive mode; strictest also blocks Acceptable and Ambiguous
`routing.http.preserve_host_header.enabled`	true/false	false	When off, a non-default listener port is appended to `Host`, and a port on 80/443 is stripped
`deletion_protection.enabled`	true/false	false	Must be turned off before deleting

aws elbv2 modify-load-balancer-attributes --load-balancer-arn <lb> \
  --attributes Key=idle_timeout.timeout_seconds,Value=120 Key=deletion_protection.enabled,Value=true

Other fixed timeouts

Connection to a target: 10 s, then 504.
TLS handshake to a target: 10 s, then 504.
HTTP/2 connections are closed after 10,000 requests.
Header limits: 16 KB per request line, 16 KB per header, 64 KB in total; 32 KB of response headers from a target.
Lambda targets: 1 MB request and response bodies.