Route 53 Health Check Failing
What does ZopNight detect here?
Route 53 health checks stuck in FAILURE status with zero referencing DNS zones are true orphans: nothing depends on them, yet each accrues its fixed standing fee, roughly $0.50 per month. ZopNight categorizes the delete as orphan so the small saving survives the $5 low-savings floor, abstaining while failover records still reference the check.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1525 |
| Category | orphan |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | route53_health_check.go |
Where it applies
A failing check that no zone references
- metadata: healthCheckStatus=FAILURE (provider-authoritative; the discoverer derives it from the Route 53 GetHealthCheckStatus control-plane API and writes meta[“healthCheckStatus”] at route53_healthcheck.go:420). The prior tag: status=FAILURE read was a dead contract (wrong key and wrong field, never written to Tags).
- metadata: referencedByCount (JSON number = len(zones) referencing the check, via getMetadataFloat → -1 when absent). >0 => failover records still depend on it => the rule abstains (the lever is “fix the endpoint”, not delete); ==0 => authoritatively unreferenced + failing => true orphan, emit delete and stamp Specs[“source_exists”]=“false” orphan evidence (so a future Hot promotion clears safety/gate.go hasOrphanEvidence); absent (-1) => still surface but leave Specs empty so the delete stays advisory/guided.
- PricingAware: per-resource monthly cost
- Emission gated behind the FEATURE_FLAG_BGUIDED_BLOCKED_COHORT kill-switch (read once at construction).
Why the standing fee needs the orphan category
orphan delete, full standing-fee recovery. savings = cost × route53HealthCheckSavingsFraction where the fraction is 1.00 (deleting the failing, unreferenced check reclaims its entire fixed ~$0.50/mo AWS standing fee), optimized = cost − savings. Category is orphan, not idle, and that is the load-bearing fix: the $0.50 saving can never reach the $5 low-savings floor, and shouldDropLowSavings exempts model.CategoryOrphan, so under the old idle category the rec was suppressed (marked optimised) on every run and never reached a customer. Orphan also matches the StepKindDelete lever allowlist. cost prefers the ingested billing rate (Rates.GetRate) when the account is billing-connected; only accounts with no ingested rate fall back to the flat $0.50/mo standing-fee constant, which does not account for the AWS free tier of 50 AWS-endpoint checks per account, the $0.75/mo non-AWS-endpoint rate, or the optional-feature surcharges Route 53 lists. That is a known aggregator-side pricing-fidelity gap, not fixable in this rule file.
Delete it, or fix the endpoint instead
- Confirm no DNS failover records depend on this health check
- If the monitored endpoint was decommissioned, delete the health check to stop the $0.50/month standing fee
- If the endpoint should be healthy, investigate and fix the underlying issue instead of deleting