EC2 Minimum Healthy Hosts Fleet Percentage Should Be Maintained

Using Console

In AWS, the “Minimum healthy hosts – Fleet percentage” setting is part of CodeDeploy, not CodeBuild. It controls what percentage of your fleet must remain healthy during deployments.Below are step‑by‑step instructions to remediate this using the AWS Console for a CodeDeploy deployment group.

1. Open CodeDeploy in the Console

Sign in to the AWS Management Console.
In the top search bar, type “CodeDeploy” and open CodeDeploy.

2. Select the Application and Deployment Group

In the left navigation, choose Applications.
Click the application that contains your EC2/On‑Premises deployment group.
In the Application details page, select the Deployment groups tab.
Click the specific deployment group you want to remediate.

3. Edit the Deployment Group

On the deployment group details page, choose Edit (top right).

4. Set “Minimum healthy hosts” to a Proper Fleet Percentage

Scroll to the Deployment configuration or Minimum healthy hosts section (the exact layout may vary slightly).
Look for Minimum healthy hosts:
- Select Fleet percentage (instead of an absolute host count).
- Enter an appropriate percentage, for example:
  - 50% (common default; ensures half the fleet stays healthy),
  - or a value that matches your compliance / policy requirement (e.g., ≥ 75%).
Confirm any related validation or warnings.

5. Save the Changes

Scroll to the bottom of the page.
Click Save (or Update deployment group).

6. Verify Compliance

Back on the deployment group details page, confirm that:
- Minimum healthy hosts type is set to Fleet percentage.
- The percentage value matches your required setting.
Optionally, trigger a test deployment to ensure deployments proceed without violating the minimum healthy host threshold.

If you actually meant CodeBuild (build projects) and not CodeDeploy, clarify your use case—CodeBuild itself does not have a “minimum healthy hosts fleet percentage” setting, so this control is almost certainly targeting your CodeDeploy EC2/On-Premises deployment configuration.

Using CLI

This control applies to AWS CodeDeploy (for EC2/On-Prem), not CodeBuild. You remediate it by setting the minimumHealthyHosts parameter on the deployment group to use FLEET_PERCENT with an appropriate percentage (e.g., 50%).Below are the exact AWS CLI steps.

1. Identify the application and deployment group

If you already know the application and deployment group names, skip to step 2.List CodeDeploy applications:

aws deploy list-applications

List deployment groups for an application:

aws deploy list-deployment-groups \
  --application-name MyApplicationName

2. Check current minimum healthy host settings

aws deploy get-deployment-group \
  --application-name MyApplicationName \
  --deployment-group-name MyDeploymentGroupName \
  --query 'deploymentGroupInfo.minimumHealthyHosts'

You’ll see something like:

{
  "type": "HOST_COUNT",
  "value": 1
}

{
  "type": "FLEET_PERCENT",
  "value": 0
}

3. Update to use FLEET_PERCENT with a safe percentage

Choose the percentage you want to enforce (e.g., 50). Then run:

aws deploy update-deployment-group \
  --application-name MyApplicationName \
  --current-deployment-group-name MyDeploymentGroupName \
  --minimum-healthy-hosts type=FLEET_PERCENT,value=50

You can also use JSON form:

aws deploy update-deployment-group \
  --application-name MyApplicationName \
  --current-deployment-group-name MyDeploymentGroupName \
  --minimum-healthy-hosts '{
    "type": "FLEET_PERCENT",
    "value": 50
  }'

4. Verify the change

aws deploy get-deployment-group \
  --application-name MyApplicationName \
  --deployment-group-name MyDeploymentGroupName \
  --query 'deploymentGroupInfo.minimumHealthyHosts'

Expected:

{
  "type": "FLEET_PERCENT",
  "value": 50
}

This ensures that during deployments, CodeDeploy maintains at least 50% of your EC2 fleet in a healthy state.

Using Python

This setting doesn’t live in CodeBuild itself; it’s a CodeDeploy deployment group property that controls how many EC2 hosts must stay in service during a deployment. To “remediate” it, you need to update the deployment group that CodeBuild/CodePipeline ultimately deploys to.Below are concise step‑by‑step instructions, including a Python (boto3) example.

1. Decide the minimum healthy hosts policy

You must choose one of:

type = "HOST_COUNT" and value = <integer>
e.g., require at least 2 healthy instances at all times

type = "FLEET_PERCENT" and value = <0‑100>
e.g., require at least 50% of the fleet to remain healthy

For your finding (“Minimum Healthy Hosts Fleet Percentage Should Be Maintained”), you’ll want:

minimumHealthyHosts:
  type: FLEET_PERCENT
  value: 50   # or whatever your policy requires

2. Console remediation (for quick verification)

Go to AWS CodeDeploy console.
Choose Applications → select your application.
Choose Deployment groups → select your EC2/On‑Premises deployment group.
Click Edit.
Under Deployment configuration / Minimum healthy hosts, select:
- Percentage of fleet and set the percentage (e.g., 50).
Save the deployment group.

This directly fixes the misconfiguration and is useful to verify the behavior before automating.

3. Python (boto3) remediation

You can programmatically enforce a minimum healthy hosts fleet percentage using update_deployment_group.

3.1. Install and configure boto3 (if not already)

pip install boto3
aws configure  # or otherwise configure credentials/role

3.2. Update the deployment group

import boto3

codedeploy = boto3.client("codedeploy", region_name="us-east-1")  # adjust region

APPLICATION_NAME = "your-codedeploy-application-name"
DEPLOYMENT_GROUP_NAME = "your-deployment-group-name"

def set_minimum_healthy_fleet_percent(app_name, dg_name, percent):
    """
    Set minimumHealthyHosts to FLEET_PERCENT with the given percentage.
    """
    response = codedeploy.update_deployment_group(
        applicationName=app_name,
        currentDeploymentGroupName=dg_name,
        minimumHealthyHosts={
            "type": "FLEET_PERCENT",
            "value": percent,
        },
    )
    return response

if __name__ == "__main__":
    # Example: require at least 50% of EC2 instances to remain healthy
    resp = set_minimum_healthy_fleet_percent(
        APPLICATION_NAME,
        DEPLOYMENT_GROUP_NAME,
        50,
    )
    print("Updated deployment group:", resp.get("deploymentGroupId"))

Adjust:

region_name
APPLICATION_NAME
DEPLOYMENT_GROUP_NAME
percent (e.g., 50 or higher, per your compliance requirement)

4. Integrate with CodeBuild / pipelines

If CodeBuild is part of a CI/CD pipeline (e.g., CodePipeline) that deploys via CodeDeploy:

Run this script as:
- A one‑time remediation (manual run or separate job), or
- A CodeBuild step in your pipeline that ensures the deployment group always has the desired setting before deployment.

In CodeBuild:

Add a buildspec phase (e.g., pre_build) to run the Python script.
Ensure the CodeBuild role has codedeploy:UpdateDeploymentGroup permission.

Example buildspec.yml snippet:

version: 0.2

phases:
  pre_build:
    commands:
      - pip install boto3
      - python set_minimum_healthy_hosts.py
  build:
    commands:
      - # your existing build commands

This ensures the Minimum Healthy Hosts Fleet Percentage is enforced automatically as part of your build/deploy flow.

Using Terraform

resource "aws_codedeploy_deployment_group" "EC2_DEPLOYMENT_GROUP" {
  app_name              = aws_codedeploy_app.CODEDEPLOY_APP.name  # replace with your app resource or name
  deployment_group_name = "DEPLOYMENT_GROUP_NAME"                  # replace with your deployment group name
  service_role_arn      = aws_iam_role.CODEDEPLOY_SERVICE_ROLE.arn # replace with your IAM role

  # Require at least 75% of instances to be healthy during deployments
  minimum_healthy_hosts {
    type  = "FLEET_PERCENT"
    value = 75  # adjust to your required minimum healthy fleet percentage
  }

  # ...other configuration (load_balancer_info, auto_rollback_configuration, etc.)...
}

This updates the same minimum_healthy_hosts setting as the CLI command (type = "FLEET_PERCENT", value = 75) and is applied in-place without forcing replacement of the deployment group; ensure the percentage suits your availability requirements.To verify, terraform plan should show an update to aws_codedeploy_deployment_group.EC2_DEPLOYMENT_GROUP.minimum_healthy_hosts[0].type and .value, with no create/destroy of the deployment group.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

EC2 Minimum Healthy Hosts Fleet Percentage Should Be Maintained

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Open CodeDeploy in the Console

2. Select the Application and Deployment Group

3. Edit the Deployment Group

4. Set “Minimum healthy hosts” to a Proper Fleet Percentage

5. Save the Changes

6. Verify Compliance

1. Identify the application and deployment group

2. Check current minimum healthy host settings

3. Update to use FLEET_PERCENT with a safe percentage

4. Verify the change

1. Decide the minimum healthy hosts policy

2. Console remediation (for quick verification)

3. Python (boto3) remediation

3.1. Install and configure boto3 (if not already)

3.2. Update the deployment group

4. Integrate with CodeBuild / pipelines

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Open CodeDeploy in the Console

​2. Select the Application and Deployment Group

​3. Edit the Deployment Group

​4. Set “Minimum healthy hosts” to a Proper Fleet Percentage

​5. Save the Changes

​6. Verify Compliance

​1. Identify the application and deployment group

​2. Check current minimum healthy host settings

​3. Update to use FLEET_PERCENT with a safe percentage

​4. Verify the change

​1. Decide the minimum healthy hosts policy

​2. Console remediation (for quick verification)

​3. Python (boto3) remediation

​3.1. Install and configure boto3 (if not already)

​3.2. Update the deployment group

​4. Integrate with CodeBuild / pipelines

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Open CodeDeploy in the Console

2. Select the Application and Deployment Group

3. Edit the Deployment Group

4. Set “Minimum healthy hosts” to a Proper Fleet Percentage

5. Save the Changes

6. Verify Compliance

1. Identify the application and deployment group

2. Check current minimum healthy host settings

3. Update to use FLEET_PERCENT with a safe percentage

4. Verify the change

1. Decide the minimum healthy hosts policy

2. Console remediation (for quick verification)

3. Python (boto3) remediation

3.1. Install and configure boto3 (if not already)

3.2. Update the deployment group

4. Integrate with CodeBuild / pipelines

Additional Reading: