Back to Checks
aws

Elastic Beanstalk environment has enhanced health reporting enabled

elasticbeanstalk_environment_enhanced_health_reporting
Service: elasticbeanstalkSeverity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsElasticBeanstalkEnvironment

Elastic Beanstalk environments have health reporting set to enhanced instead of basic.

Prowler logoProwlerprowler-provider-aws

Risk

Without enhanced health, issues are detected late, raising MTTR and enabling service outages. Hidden instance failures or bad deployments can create uneven fleets, degrading availability and potentially integrity (serving stale versions), while error spikes and thrash increase operational cost.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elasticbeanstalk_environment_enhanced_health_reporting

Recommendation

Set health reporting to enhanced for all environments and make it a security baseline. Connect health signals to alerts for rapid response. Apply least privilege to required roles and use defense in depth with auto-healing, alarms, and runbooks to prevent prolonged degradation.

Remediation

CLI

aws elasticbeanstalk update-environment --environment-name <environment-name> --option-settings Namespace=aws:elasticbeanstalk:healthreporting:system,OptionName=SystemType,Value=enhanced

Terraform

# Terraform: enable enhanced health reporting for an Elastic Beanstalk environment
resource "aws_elastic_beanstalk_environment" "<example_resource_name>" {
  name                = "<example_resource_name>"
  application         = "<example_resource_name>"
  solution_stack_name = "<example_solution_stack>"

  setting {
    namespace = "aws:elasticbeanstalk:healthreporting:system"
    name      = "SystemType"  # Critical: selects the enhanced health reporting system
    value     = "enhanced"    # Critical: sets health reporting to enhanced
  }
}

NativeIaC

# CloudFormation: enable enhanced health reporting for an Elastic Beanstalk environment
Resources:
  <example_resource_name>:
    Type: AWS::ElasticBeanstalk::Environment
    Properties:
      ApplicationName: <example_resource_name>
      EnvironmentName: <example_resource_name>
      SolutionStackName: <example_solution_stack>
      OptionSettings:
        - Namespace: aws:elasticbeanstalk:healthreporting:system
          OptionName: SystemType  # Critical: selects the enhanced health reporting system
          Value: enhanced          # Critical: sets health reporting to enhanced

Other

1Open the AWS Elastic Beanstalk console and select your Region
2Go to Environments and choose your environment
3Select Configuration > Monitoring > Edit
4Under Health reporting, set System to Enhanced
5Click Apply to save the change

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_client import (
    elasticbeanstalk_client,
)


class elasticbeanstalk_environment_enhanced_health_reporting(Check):
    def execute(self):
        findings = []
        for environment in elasticbeanstalk_client.environments.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=environment)
            report.status = "PASS"
            report.status_extended = f"Elastic Beanstalk environment {environment.name} has enhanced health reporting enabled."

            if environment.health_reporting != "enhanced":
                report.status = "FAIL"
                report.status_extended = f"Elastic Beanstalk environment {environment.name} does not have enhanced health reporting enabled."

            findings.append(report)

        return findings

References