A Route 53 Health Check with the Alarm that Makes a Failure a Notification
A Route 53 health check over HTTPS with SNI, a search string so the page must render, latency measured, probed from several regions, and the CloudWatch alarm on HealthCheckStatus that sends to your topic on failure and recovery. The metrics live only in us-east-1 and the module refuses any other region; HTTP or TCP probes and a missing topic are accepted by name.
Verification
Live-testedReally deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan test superseded by live test
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested on registry.opentofu.org/hashicorp/aws - applied, verified, destroyed
Last verified 2026-10-31 · tofu 1.12.1 · how we verify
Use it from the registry
terraform · opentofumodule "route53_health_check" {
source = "www.iac-bazaar.com/iac-bazaar/aws-route53-health-check/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/aws-route53-health-check?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, live-tested on IaC Bazaar: [A Route 53 Health Check with the Alarm that Makes a Failure a Notification](https://www.iac-bazaar.com/catalog/aws-route53-health-check?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "route53_health_check" {
source = "www.iac-bazaar.com/iac-bazaar/aws-route53-health-check/aws"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-route53-health-check
A Route 53 health check with the CloudWatch alarm that makes a failure
a notification. Works with Terraform and OpenTofu (>= 1.6), aws
provider >= 6.0, < 7.0, and needs a us-east-1 provider because
that is where the metrics live.
A health check with no alarm is a graph; the alarm is here, a topic required or its absence accepted by name.
HTTPS, verified, with a string; HTTP or TCP by name.
The probes come from public addresses; the endpoint must admit the Route 53 checker ranges.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-dns-firewall
Domain lists, rule group, rules and VPC associations. Fail-open is an availability decision wearing a security name: closed makes a firewall fault a DNS outage, open resolves unfiltered without saying so. The module makes you choose.
aws-route53-resolver
Endpoints that carry DNS across the VPC boundary, with a precondition requiring addresses in two different subnets - the part the API does not check, and the reason a zone failure becomes every application failing at once.
aws-route53
A Route 53 hosted zone (public or private via vpc_ids) plus a map-driven set of records, with name normalisation and the alias-vs-rdata distinction resolved and inputs validated.
cloudflare-health-check
A health check on an origin with allow_insecure false, since an origin whose certificate expired last week passes a check that was told not to look. expected_body is what tests the application rather than the web server, because an error page, a maintenance page and a page saying the database is unreachable are all 200s. Two consecutive failures, not one.
do-uptime-check
An uptime check and its alerts, which are separate resources: a check on its own draws a graph somebody would have to go and look at and pages nobody, and it looks identical to one that does. Three regions by default, since one cannot tell the target being down apart from that region's path to it. The latency alert is the one that catches the slow death.
gcp-uptime-check
A Cloud Monitoring uptime check from static-address checkers in several regions, over TLS with the certificate validated (off by default), asserting on the body when you give it text, with failures logged, and the alert policy on check_passed that sends to your notification channels. Plain HTTP and a policy with no channels are each accepted by name.