AWS TargetGroup/LoadBalancer checks vs CodeDeploy deployment group status

Question

Let's assume the following situation.

TargetGroup is checking the http port 80 to verify that a EC2 host is healthy.

CodeDeploy agent executed a sequence like this

1. ApplicationStop SUCCESS (Stopped web engine. Cannot serve port 80)
2. BeforeInstall SUCCESS
3. AfterInstall SUCCESS
4. ApplicationStart SUCCESS (Started web engine. Can serve port 80)
5. ValidateService FAILED (non related to the availability of the port 80)

With this sequence the CodeDeploy deployment is marked as FAILED. What is the target group doing? As it's health check would be successful, it would consider the EC2 host as healthy? But CodeDeploy things it's not.

What is not clear to me is how TargetGroup health checks overlap with CodeDeploy deployment's status on each EC2.

As the documentation mentions that CodeDeploy collaborates with the load balancer to not route traffic, then my question is extended to the load balancer as well.

Any insight would be appreciated.

After some discussion with @tangerini:

In AppSpec 'hooks' Section it mentions that e.g. Allow/Block Trafic hooks are available. But also on the same topic it mentions that someone can use them only with - a classic loadbalancer - a blue/green deployment.

I'm using a ApplicationLoadBalancer and in-place deployments. But from what I've noticed the traffic reaches the ec2 servers during the ValidateService hook.

Answer 1

CodeDeploy's deployment status depends solely on the success or failure of the lifecyle event hooks being executed on your instances, and does not necessarily follows the TargetGroup health checks. In your example, the ApplicationStart step completed successfully, which will cause it to start succeeding the TargetGroup health check, even though the ValidateService step failed thus causing the deployment to fail.

Ideally, you want the TargetGroup health check status to match the CodeDeploy ValidateService result every time. If the ValidateService step fails, it means your service is not functioning correctly and should be failing the health check. But that depends on the validation that you are doing in your ValidateService step.