Health Checks and Advanced Routing

Health determines available answers

Route 53 health checkers in several AWS locations probe public endpoints with HTTP, HTTPS, or TCP. An endpoint is healthy when more than 18% of checkers report it healthy. HTTPS checks establish TLS but do not validate certificate correctness like a browser. CloudWatch alarms can also feed health checks, and calculated health checks combine several others with AND/OR logic.

flowchart LR
  HC["Health checkers<br/>many locations"] --> P["Primary<br/>ALB ap-southeast-1"]
  P -- "unhealthy" --> F["Failover policy"]
  F --> S["Secondary<br/>DR Region or S3 page"]
  G["Geolocation<br/>user in Vietnam"] --> VN["Vietnam record"]
  G --> DEF["Default record<br/>everyone else"]
  %% step HC: Checkers send requests every 30 seconds (or 10 with fast interval) from around the world.
  %% step P: While the primary answers correctly, Route 53 returns it.
  %% step F: When the primary is marked unhealthy, failover routing switches the answer.
  %% step S: The secondary can be another Region or a static maintenance page on S3.
  %% step G: Geolocation matches the user's continent or country.
  %% step VN: Users located in Vietnam get the Vietnam endpoint.
  %% step DEF: A default record catches locations without a specific match; without it they get no answer.

Health check types

Health checkers must reach the endpoint; a firewall allowing only corporate CIDRs can make the check fail. Allow the published Route 53 health checker IP ranges. A health check can also send an SNS notification through a CloudWatch alarm.

Advanced routing policies

Failover is active-passive: it returns the secondary when the primary is unhealthy. Attach a health check to the primary (or use Alias with Evaluate Target Health).

Geolocation matches user location and needs a default record for unmatched locations. Useful for language-specific sites or content-licensing rules. It is about where the user is, not about latency.

Geoproximity (in Route 53 Traffic Flow) considers user and resource locations plus a bias that grows or shrinks a resource's area, letting you shift traffic between Regions gradually.

Multivalue answer returns up to eight healthy records and supports per-record health checks, but it does not proxy, drain connections, or replace an ELB.

IP-based routing maps client CIDR blocks you upload to specific endpoints.

Combining policies

Policies can be nested with Traffic Flow visual policies or by pointing Alias records at other records: for example latency routing between two Regions, and inside each Region weighted routing between two versions, each with health checks. Keep it as simple as the requirement allows; every layer adds DNS lookups and things to debug.

Traps: a geolocation setup without a default record; health checks blocked by a firewall; treating multivalue answer as a load balancer.