EC2 application status checks close a gap that every AWS engineer has patched over with duct tape at some point: the space between “the instance is running” and “the application on it actually works.” AWS made this generally available on August 10, 2026, and if you’ve ever had an instance pass every system check while its web server quietly hung, you know exactly why this matters.
The gap EC2 application status checks actually fill
Classic EC2 instance and system status checks monitor infrastructure: is the host healthy, is the network path to the instance intact, did the underlying hardware fault. They know nothing about your process tree. An nginx worker that segfaults, a Docker daemon that quietly dies, a misconfigured security group that blocks the app port while SSH stays open — all invisible to those checks, all painfully visible to your users. Historically you covered that gap yourself: a cron job pinging a health endpoint, a sidecar script bouncing the process, a Lambda polling an ALB target group and paging someone. It worked, but you owned it — patched it, tuned its timeouts, and got blamed when it drifted out of sync with reality.
Application status checks fold that logic into EC2 itself. You define what “healthy” means for your app, associate the check with instances, and EC2 handles the polling loop.
How the check configuration works
A check is defined by four things: protocol (HTTP or HTTPS), port, path, and the response codes that count as healthy. That’s it — no custom scripting language, no agent to install. Under the hood, EC2 sends a request to that port and path on the instance’s network interface and evaluates the returned status code against your allow-list.
This is deliberately unopinionated about what “healthy” means to your application. Some teams point it at a trivial liveness endpoint that just confirms the process is alive and accepting connections. Others build a slightly heavier readiness endpoint that checks whether the app has finished warming caches or established its database connection pool before reporting 200. Both are valid — the check itself doesn’t care, it just evaluates whatever status code your endpoint returns against the codes you told it to treat as healthy. The design decision is yours, and it should match how aggressively you want the downstream Auto Scaling behavior to react.
aws ec2 create-application-status-check \
--protocol HTTP \
--port 8080 \
--path /health \
--healthy-response-codes 200,204 \
--description "checkout-service liveness check"That call returns a check ID. You can define multiple checks per account — one for a web tier on port 80, another for an internal API on 8443 with HTTPS, another for a batch worker exposing a lightweight /ready endpoint. Nothing forces you to reuse the same check config across dissimilar fleets, which is the right call, because a checkout service and a background worker have very different definitions of “fine.”
Associating checks: instance ID or tag
You can bind a check directly to specific instances, which is fine for a one-off box you care about, or — more usefully — to a tag, which means every instance carrying that tag inherits the check automatically as your fleet scales up and down.
aws ec2 associate-application-status-check \
--check-id ascheck-0123456789abcdef0 \
--instance-ids i-0abcd1234efgh5678
aws ec2 associate-application-status-check \
--check-id ascheck-0123456789abcdef0 \
--tags Key=App,Value=checkout-serviceTag-based association is the one worth building around. Bake the tag into your launch template or your Auto Scaling group’s instance definition, and new instances start reporting application health the moment they’re up — no manual step, no drift between what your fleet looks like and what’s actually being monitored.
The 60-second polling model
EC2 evaluates each associated check every 60 seconds and reports application status alongside the existing instance and system status in describe-instance-status output. There’s no configurable interval, no jittered backoff you need to reason about — it’s a flat, predictable cadence. That’s a deliberate simplicity tradeoff: you’re not getting sub-second detection, but you are getting something that behaves the same way on every instance in your account without you tuning it.
aws ec2 describe-instance-status \
--instance-ids i-0abcd1234efgh5678 \
--include-all-instancesThe response now carries an ApplicationStatus block alongside InstanceStatus and SystemStatus, so anything already parsing that API — dashboards, runbooks, custom tooling — gets the new signal without a structural rewrite.
How this complements instance and system status checks
Think of the three checks as layers, not competitors. System status checks watch the hardware and hypervisor layer underneath your instance. Instance status checks watch the OS and networking configuration of the instance itself. Application status checks watch whether the thing you actually deployed is doing its job. An instance can pass the first two and still be functionally dead to your users — that’s precisely the failure mode this closes. None of them replace the others; together they give you a full-stack health picture without three separate monitoring systems.
CloudWatch integration and pricing
Application status results flow into the same status check ecosystem that already feeds Amazon CloudWatch, so you can alarm on status transitions the same way you already alarm on instance status, and route those alarms through SNS notifications or automated remediation. If you’re running an Auto Scaling group, this is where it gets genuinely useful — the ASG can act on application status directly, which we dig into separately. Check pricing details in the official documentation before rolling this out fleet-wide, since cost scales with how many checks and instances you associate.
Regional availability and rollout considerations
Application status checks are available in every commercial AWS Region as well as AWS GovCloud (US), so there’s no regional gap forcing you to run a parallel homegrown solution for part of your fleet. That matters for teams standardizing a single health-check strategy across multi-region deployments — you’re not stuck maintaining one approach for commercial regions and a different one for a GovCloud workload. Before rolling out broadly, audit what health-check logic you’re already running in user-data scripts or sidecar containers; there’s a real chance some of that can be retired outright once this native check covers the same ground, which is one less thing your team has to patch during the next OS upgrade cycle.
Where to start
If you’re running anything stateful behind an ALB where target group health checks only tell part of the story, or anything without a load balancer at all — batch processors, internal services, self-managed clusters — application status checks are a low-effort way to get real signal. Start with one check on your noisiest fleet, tag-associate it, and watch what it catches that your existing monitoring missed. It’ll catch something.
At Enkompass (enkompass.net), this is our home turf. We roll out new EC2 monitoring capabilities into client fleets the same week they hit GA, so you get faster failure detection without spending a sprint reverse-engineering the API yourself. If you’d rather have seasoned cloud people handle it instead of learning the hard way at 2 AM, let’s talk. Reach out through our contact page or call us directly at +1-828-436-5667 — we’ll help you turn this from a someday-project into a done-deal.