I have an entirely message-driven workload running in ECS Fargate without a load balancer and with a health check defined in the container definition. For monitoring the application I would like to define a cloudwatch alarm that triggers whenever tasks get unhealthy.
For my HTTP workloads I use a metric alarm based on the UnhealthyHostCount metric to achieve this. How can I do it without a load balancer?
There doesn't appear to be any metric reported to CloudWatch when container health checks fail. There also doesn't appear to be any events posted to EventBridge by ECS when a container health check fails. You could subscribe to the ECS EventBridge events, to know when a task is entering one of the PENDING, RUNNING or STOPPED states, but those don't really indicate the task health, and could end up spamming your inbox with too many notifications to be useful.
The official AWS documentation on container health checks recommends forwarding your health check command's output to CloudWatch Logs. If you did that, then you could configure a CloudWatch Log alarm based on specific text appearing in the log that indicates the health check has failed.