title: ElasticBeanstalk deployment on custom VPC (None of the instances are sending data)
body: <p>I have set up a new <code>VPC</code> in my AWS account, using their new wizard, which creates all the necessary resources (igw, natgw, public/private subnets, routing tables, etc.)</p>
  <p>After spinning up tens of ElasticBeanstalk environments, I have come to conclusion that the instances are not able to reach <code>elasticbeanstalk-health.us-east-1.amazonaws.com</code>, and therefore EB fails the initial deployment of the environment:</p>
  <p><a href="https://i.stack.imgur.com/tLZ0Y.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/tLZ0Y.png" alt="enter image description here" /></a></p>
  <h4>The EB configuration:</h4>
  <ol>
  <li>Instances are deployed to the public subnets, allocated public IP (<strong>they can reach the internet</strong>)</li>
  <li>Instances are assigned the default SGs created by EB, <strong>and also the VPC's default SG</strong>.</li>
  <li>The application load balancer is publicly available, deployed on the public subnets and can reach the instances.
  <ol>
  <li>However, the healthcheck fails because nothing responds from the instance's side, because the EB default app is not yet installed.</li>
  <li>I can verify the load balancer can reach the instance thanks to opening a socket on the relevant port (<code>nc -l -p 80</code>) and seeing the LB healthcheck requests being received.</li>
  </ol>
  </li>
  </ol>
  <h4>Troubleshooting further:</h4>
  <ol>
  <li><p>I have SSH'ed into one of the instances and tried connecting EB's health endpoint -- without any success.</p>
  </li>
  <li><p>Testing from my own laptop, the connection succeeds.</p>
  </li>
  <li><p>The issue roots to the DNS resolution of the health endpoint:</p>
  <ol>
  <li>From my own computer: <code>PING elasticbeanstalk-health.us-east-1.amazonaws.com (35.170.164.93)</code></li>
  <li>From the EB instance: <code>PING elasticbeanstalk-health.us-east-1.amazonaws.com (10.0.154.188)</code></li>
  <li>The difference in IPs is not what bothers me, <strong>but what does</strong> is that on the instance the resolved IP begins with <code>10.0.xxx.xxx</code> -- <strong>which is configured to be routed to _local_</strong> in the routing tables, as the VPC's default CIDR is <code>10.0.0.0/16</code>.</li>
  </ol>
  </li>
  <li><p>Reminder that this is public subnet, so there's no point in associating VPC Endpoint to EB/EB-health endpoints.</p>
  </li>
  </ol>
  <p>I'm wondering why the EB-health hostname is resolved to such IP address, and by whom, as it definitely should be resolved a public IP address available to the internet.</p>