AWS Security Hub · ElasticBeanstalk
ElasticBeanstalk.1: Environments should have enhanced health reporting
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub ElasticBeanstalk.1 check?
ElasticBeanstalk.1 fails when an Elastic Beanstalk environment uses basic health reporting instead of enhanced. Enhanced reporting runs an on-instance agent that reports detailed application and system metrics.
Why does ElasticBeanstalk.1 matter?
Basic health reporting only watches the load balancer and a coarse colour status, so a degrading application (rising latency, climbing error rates, failing requests) can look green until it falls over. Enhanced reporting's on-instance agent surfaces per-instance CPU, latency and HTTP status detail, giving you the signal to catch and act on a problem before it becomes an outage.
How do I fix ElasticBeanstalk.1?
- Audit which environments are on basic versus enhanced with describe-environments and describe-configuration-settings.
- Set SystemType to enhanced in the aws:elasticbeanstalk:healthreporting:system option settings and apply with update-environment.
- Ensure the environment's instance profile and platform support enhanced reporting (the required service role must exist).
- Bake the setting into a saved configuration so new environments default to enhanced.
Remediation script · bash
# Remediate one environment: set SystemType to enhanced.
aws elasticbeanstalk update-environment \
--environment-name orders-api-prod \
--option-settings \
Namespace=aws:elasticbeanstalk:healthreporting:system,OptionName=SystemType,Value=enhanced
# Verify the setting took effect.
aws elasticbeanstalk describe-configuration-settings \
--application-name orders-api \
--environment-name orders-api-prod \
--query 'ConfigurationSettings[0].OptionSettings[?OptionName==`SystemType`].Value' \
--output text
# Confirm the environment is reporting detailed health (not stuck Grey).
aws elasticbeanstalk describe-environment-health \
--environment-name orders-api-prod \
--attribute-names All \
--query '{Status:Status,Color:Color,Causes:Causes}'Full walkthrough (console steps, edge cases and verification) in the lesson Enable enhanced health reporting on Elastic Beanstalk environments.
Is ElasticBeanstalk.1 a false positive?
Enhanced health reporting is not available for every Beanstalk environment: single-instance environments have no load balancer and worker-tier environments process from a queue rather than serving requests, so the enhanced model fits awkwardly, and some older or custom platforms predate the on-instance health agent. An environment that legitimately runs on one of these configurations can fail this Low-severity control even though basic reporting is the only supported option. Confirm the platform and environment type genuinely cannot support enhanced reporting, then suppress the finding with a note recording the platform version and tier rather than forcing a setting the environment cannot accept, and revisit if you later move the workload to a load-balanced environment on a current platform.
More ElasticBeanstalk controls
- ElasticBeanstalk.2 Managed platform updates are disabled
- ElasticBeanstalk.3 Beanstalk logs are not streamed to CloudWatch