Will the "TargetConnectionErrorCount" be counted even if there are two servers in the target group and one cannot respond?

Hi, and thanks for reaching out!

The TargetConnectionErrorCount metric will increment any time the ALB encounters an error in establishing a TCP connection with a target. In this case, it sounds like the first failed request that was made after changing the Security Group was still in flight over the connection that is maintained between an ALB and a target. This would not increment the TargetConnectionErrorCount metric.

The next request after this may have then come in after the second target had already been marked Unhealthy, and therefore no further requests were routed to it.

In the case of all targets being unhealthy, the ALB exhibits fail-open behavior, routing requests to all registered targets, regardless of health status. As a result, the ALB attempts to make connections with each of them, but fails in each attempt, causing the TargetConnectionErrorCount to increment.

Hope this helps!