External monitoring from AWS or a colo. Simple icmp checks and tcp connects + possible up to app layer checks allowed from these failsafes. Obfuscate as needed.