Load Balancer 502, 503 and 504 Errors

Sign in and set names:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json

1Launch two app servers with a misbehaving app

Paste this whole block. The app answers / and /health, sleeps on /slow, and drops the connection on /crash:

$ud = @'
#!/bin/bash
cat > /opt/app.py <<'EOF'
import http.server, socket, time
class H(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == '/crash':
            self.connection.shutdown(socket.SHUT_RDWR)
            return
        if self.path == '/slow':
            time.sleep(15)
        if self.path not in ('/', '/health', '/slow'):
            self.send_error(404)
            return
        body = ('hello from ' + socket.gethostname() + '\n').encode()
        self.send_response(200)
        self.send_header('Content-Length', str(len(body)))
        self.end_headers()
        self.wfile.write(body)
    def log_message(self, *args):
        pass
http.server.ThreadingHTTPServer(('', 8080), H).serve_forever()
EOF
systemd-run --unit=app8080 python3 /opt/app.py
'@
$ud = $ud.Replace([string][char]13, '')
$ami = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$ids = foreach ($s in @(@('web66a', $v.PrivateA), @('web66b', $v.PrivateB))) {
  aws ec2 run-instances --image-id $ami --instance-type t3.micro --subnet-id $s[1] --security-group-ids $v.AppSg --metadata-options HttpTokens=required --user-data $ud --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=$($s[0])},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=66}]" --query "Instances[0].InstanceId" --output text
}
aws ec2 wait instance-running --instance-ids $ids
$ids -join ' '

You should see something like this:

i-0a1b2c3d4e5f60718 i-0b2c3d4e5f6a70819

The servers sit in private subnets with AppSg, which accepts 8080 only from WebSg, the load balancer’s group. The [char]13 line strips Windows line endings, which would break the script (Lesson 11).

2Put an ALB in front and check health

Paste this whole block. The idle timeout is set to 10 seconds so the 504 test is quick:

$tg = aws elbv2 create-target-group --name saat-tg66 --protocol HTTP --port 8080 --vpc-id $v.VpcId --target-type instance --health-check-path /health --health-check-interval-seconds 10 --healthy-threshold-count 2 --unhealthy-threshold-count 2 --query "TargetGroups[0].TargetGroupArn" --output text
aws elbv2 register-targets --target-group-arn $tg --targets "Id=$($ids[0])" "Id=$($ids[1])"
$alb = aws elbv2 create-load-balancer --name saat-alb66 --type application --subnets $v.PublicA $v.PublicB --security-groups $v.WebSg --tags Key=course,Value=saatvedha-aws --query "LoadBalancers[0].LoadBalancerArn" --output text
aws elbv2 modify-load-balancer-attributes --load-balancer-arn $alb --attributes Key=idle_timeout.timeout_seconds,Value=10 | Out-Null
aws elbv2 create-listener --load-balancer-arn $alb --protocol HTTP --port 80 --default-actions "Type=forward,TargetGroupArn=$tg" | Out-Null
aws elbv2 wait load-balancer-available --load-balancer-arns $alb
aws elbv2 wait target-in-service --target-group-arn $tg --targets "Id=$($ids[0])" "Id=$($ids[1])"
$dns = aws elbv2 describe-load-balancers --load-balancer-arns $alb --query "LoadBalancers[0].DNSName" --output text
function Get-Code([string]$Path) {
  $sw = [Diagnostics.Stopwatch]::StartNew()
  try { $r = Invoke-WebRequest "http://$dns$Path" -UseBasicParsing -TimeoutSec 30; $code = $r.StatusCode; $body = $r.Content.Trim() } catch { $code = [int]$_.Exception.Response.StatusCode; $body = '' }
  '{0,-8} {1}  {2:N1} s  {3}' -f $Path, $code, $sw.Elapsed.TotalSeconds, $body
}
function Get-Health { aws elbv2 describe-target-health --target-group-arn $tg --query "TargetHealthDescriptions[].[Target.Id,TargetHealth.State,TargetHealth.Reason]" --output text }
Get-Health
Get-Code /

You should see something like this:

i-0a1b2c3d4e5f60718     healthy None
i-0b2c3d4e5f6a70819     healthy None
/        200  0.1 s  hello from ip-10-20-11-66.ap-south-1.compute.internal

3Produce 502, 504 and 503

Paste this whole block:

Get-Code /crash
Get-Code /slow
aws elbv2 deregister-targets --target-group-arn $tg --targets "Id=$($ids[0])" "Id=$($ids[1])"
Start-Sleep 70
Get-Code /
aws elbv2 register-targets --target-group-arn $tg --targets "Id=$($ids[0])" "Id=$($ids[1])"
aws elbv2 wait target-in-service --target-group-arn $tg --targets "Id=$($ids[0])" "Id=$($ids[1])"
$lbDim = ($alb -split ':loadbalancer/')[1]
$e = (Get-Date).ToUniversalTime(); $s = $e.AddMinutes(-15)
foreach ($m in 'HTTPCode_ELB_502_Count', 'HTTPCode_ELB_503_Count', 'HTTPCode_ELB_504_Count', 'HTTPCode_Target_5XX_Count') { "$m = $(aws cloudwatch get-metric-statistics --namespace AWS/ApplicationELB --metric-name $m --dimensions Name=LoadBalancer,Value=$lbDim --start-time $s.ToString('o') --end-time $e.ToString('o') --period 900 --statistics Sum --query 'Datapoints[0].Sum' --output text)" }

You should see something like this:

/crash   502  0.1 s
/slow    504  10.1 s
/        503  0.0 s
HTTPCode_ELB_502_Count = 1.0
HTTPCode_ELB_503_Count = 1.0
HTTPCode_ELB_504_Count = 1.0
HTTPCode_Target_5XX_Count = None

All three errors came from the load balancer, not the app (Target_5XX is empty): 502 when the target dropped the connection, 504 when it took longer than the 10-second idle timeout, 503 when there were no targets (after a 60-second deregistration delay).

✅ Checkpoint: Both targets are healthy, / returns 200, /crash gives 502, /slow gives 504 after 10 seconds, an empty target group gives 503, and the ELB metrics count each one.