Management and Governance

AWS Trusted Advisor

Focused AWS Solutions Architect Associate notes from the Management and Governance domain.

AWS Trusted Advisor#

AWS Trusted Advisor Overview#

  • Definition: AWS Trusted Advisor is a service that provides real-time recommendations to optimize AWS resources, improve security, enhance performance, increase resilience, and ensure compliance based on AWS best practices.
  • Key Features:
    • Performs automated checks across five categories: Cost Optimization, Security, Fault Tolerance, Performance, and Service Limits.
    • Provides actionable recommendations with severity levels (e.g., red, yellow, green).
    • Integrates with CloudWatch Events, SNS, and Security Hub for notifications and automation.
    • Offers a dashboard/console and API for accessing recommendations.
  • Use Cases: Reduce costs (e.g., unused EC2 instances), improve security (e.g., open S3 buckets), enhance resilience (e.g., Multi-AZ RDS), optimize performance (e.g., high-utilization EC2), manage service quotas.
  • Key Updates (2024–2025):
    • Enhanced Recommendations: Machine learning-driven insights for cost and security (October 2024).
    • Security Hub Integration: Centralized findings for security checks (January 2025).
    • FIPS 140-2 Compliance: Enhanced for GovCloud (October 2024).
    • Cross-Account Support: Improved visibility for AWS Organizations (March 2024).

1. Trusted Advisor Core Concepts#

Components#

  • Checks:
    • Automated evaluations of AWS resources against best practices.
    • Organized into five categories:
      • Cost Optimization: Identifies unused/underutilized resources (e.g., idle EC2 instances, unattached EBS volumes).
      • Security: Detects vulnerabilities (e.g., open S3 buckets, disabled MFA).
      • Fault Tolerance: Ensures resilience (e.g., Auto Scaling groups, Multi-AZ RDS).
      • Performance: Optimizes resource efficiency (e.g., high-utilization EC2, oversized RDS instances).
      • Service Limits: Monitors quota usage (e.g., VPCs, IAM roles).
    • Explanation: E.g., Security check flags public S3 bucket.
  • Recommendations:
    • Actionable suggestions to address check findings.
    • Severity: Red (urgent), Yellow (action recommended), Green (no issues).
    • Explanation: E.g., recommendation to delete unused EBS volume (Cost Optimization, Yellow).
  • Dashboard:
    • Console interface to view check statuses, recommendations, and trends.
    • Filters by category, severity, or resource.
    • Explanation: E.g., dashboard shows 5 red security checks.
  • Notifications:
    • Alerts via CloudWatch Events, SNS, or email for new/updated recommendations.
    • Explanation: E.g., SNS notification for red security check.
  • Priority Recommendations:
    • Curated subset of checks for Business, Enterprise On-Ramp, and Enterprise Support plans.
    • Focuses on high-impact issues (e.g., critical security vulnerabilities).
    • Explanation: E.g., prioritized recommendation to enable MFA.

Key Concepts#

  • Check Categories:
    • Over 100 checks across the five categories (varies by support plan).
    • Free Checks: 7 checks available to all AWS users (e.g., S3 bucket permissions, MFA on root account).
    • Premium Checks: Additional checks for Business/Enterprise plans (e.g., EC2 utilization, RDS Multi-AZ).
    • Explanation: E.g., free check for open S3 buckets; premium check for idle RDS instances.
  • Refresh Checks:
    • Checks run automatically (weekly/daily) or on-demand (manual refresh).
    • API supports programmatic refresh.
    • Explanation: E.g., refresh check after fixing open security group.
  • Exclusions:
    • Suppress specific recommendations to reduce noise.
    • Explanation: E.g., exclude intentional public S3 bucket from check.
  • Cross-Account Visibility:
    • Aggregates recommendations across AWS Organizations (improved 2024).
    • Explanation: E.g., view security checks for 10 accounts.
  • Trusted Advisor Priority:
    • Machine learning-driven insights for critical issues (Business/Enterprise plans).
    • Explanation: E.g., prioritize fixing exposed IAM access keys.

Key Notes:#

  • Exam Relevance: Understand check categories, free vs. premium checks, notifications, and cross-account support.
  • Mastery Tip: Compare Trusted Advisor vs. AWS Config vs. Security Hub for compliance.

2. Trusted Advisor Performance Features#

Trusted Advisor optimizes resource checks.

Low Latency#

  • Purpose: Fast recommendations.
  • Features:
    • Checks run in near-real-time for critical issues (e.g., security).
    • Dashboard updates within minutes after refresh.
  • Explanation: E.g., detect open S3 bucket in <5 minutes.
  • Exam Tip: Highlight rapid check updates for performance.

High Throughput#

  • Purpose: Handle large environments.
  • Features:
    • Processes checks for thousands of resources concurrently.
    • Scales to support large AWS Organizations.
  • Explanation: E.g., evaluate 10,000 EC2 instances for cost optimization.
  • Exam Tip: Use for high-volume environments.

Scalability#

  • Purpose: Support growing accounts.
  • Features:
    • Cross-account visibility for AWS Organizations (2024).
    • Handles millions of resources across accounts/Regions.
  • Explanation: E.g., aggregate recommendations for 1,000 accounts.
  • Exam Tip: Emphasize cross-account scalability.

Key Notes:#

  • Performance: Low latency + high throughput + scalability = efficient recommendations.
  • Exam Tip: Highlight cross-account support for enterprise environments.

3. Trusted Advisor Resilience Features#

Resilience ensures reliable recommendations.

Multi-AZ/Region Redundancy#

  • Purpose: Survive failures.
  • Features:
    • Trusted Advisor is a Regional service with multi-AZ redundancy.
    • Recommendations persist during Regional outages.
  • Explanation: E.g., access dashboard if us-east-1a fails.
  • Exam Tip: Highlight multi-AZ for HA.

Continuous Monitoring:#

  • Purpose: Uninterrupted checks.
  • Features:
    • Automated checks run 24/7 (daily/weekly cadence).
    • On-demand refresh for immediate updates.
  • Explanation: E.g., detect new open security group daily.
  • Exam Tip: Use for continuous best practice monitoring.

Monitoring and Notifications:#

  • Purpose: Track and respond to issues.
  • Features:
    • CloudWatch Events/SNS for real-time alerts.
    • CloudTrail logs Trusted Advisor API calls (e.g., RefreshTrustedAdvisorCheck).
    • Security Hub aggregates security findings (2025).
    • Explanation: E.g., SNS alert for red security check.
  • Exam Tip: Use CloudWatch Events and Security Hub for resilience.

Data Retention:#

  • Purpose: Historical insights.
  • Features:
    • Recommendations stored for analysis (retention not publicly specified).
    • Exportable via API for long-term tracking.
  • Explanation: E.g., review cost optimization trends over 6 months.
  • Exam Tip: Highlight API for retention.

Key Notes:#

  • Resilience: Multi-AZ + continuous checks + notifications = reliable best practices.
  • Exam Tip: Design resilient monitoring with SNS and Security Hub.

4. Trusted Advisor Security Features#

Security is a core focus for Trusted Advisor in SAA-C03.

Access Control#

  • IAM Policies:
    • Restrict Trusted Advisor actions (trustedadvisor:DescribeTrustedAdvisorCheckResult).
    • Scope to specific checks or accounts.
    • Example: {“Effect”: “Allow”, “Action”: “trustedadvisor:RefreshTrustedAdvisorCheck”, “Resource”: ”*”}.
  • Cross-Account Access:
    • Management account views recommendations for all accounts in AWS Organizations.
    • Explanation: E.g., restrict Trusted Advisor access to security team.
  • Exam Tip: Practice IAM policies for Trusted Advisor.

Encryption#

  • In Transit:
    • HTTPS for Trusted Advisor API calls and console.
    • Explanation: E.g., secure DescribeTrustedAdvisorCheckResult call.
  • At Rest:
    • Recommendation data encrypted with AWS-managed keys.
    • Integrates with KMS-encrypted services (e.g., S3 for exports).
    • Explanation: E.g., export recommendations to KMS-encrypted S3 bucket.
  • Exam Tip: Highlight KMS integration for compliance.

Compliance:#

  • Purpose: Meet regulatory standards.
  • Features:
    • Supports HIPAA, PCI, SOC, ISO, GDPR, FIPS 140-2 (GovCloud).
    • Security checks align with CIS Benchmarks, AWS Foundational Security Best Practices.
    • Security Hub integration for compliance findings (2025).
  • Explanation: E.g., check for MFA on IAM users for PCI compliance.
  • Exam Tip: Use Security Hub and security checks for compliance.

Auditing:#

  • Purpose: Track Trusted Advisor actions.
  • Features:
    • CloudTrail logs all API calls (e.g., ExcludeCheckItems).
    • Security Hub monitors security check compliance (2025).
    • Explanation: E.g., audit RefreshTrustedAdvisorCheck for unauthorized access.
  • Exam Tip: Use CloudTrail for auditing.

Key Notes:#

  • Security: IAM + encryption + compliance + auditing = secure recommendations.
  • Exam Tip: Configure IAM, Security Hub, and CloudTrail for secure Trusted Advisor.

5. Trusted Advisor Cost Optimization#

Cost efficiency is a key exam domain.

Pricing#

  • Trusted Advisor: Free for basic checks; premium checks require Business, Enterprise On-Ramp, or Enterprise Support plans.
  • Free Checks (all plans):
    • 7 checks: S3 bucket permissions, MFA on root, IAM access key rotation, security groups, EBS public snapshots, RDS public snapshots, service limits.
  • Premium Checks (Business/Enterprise):
    • Full access to all checks (~100+).
    • Pricing: Included in support plan cost (Business: ~$100/month, Enterprise: ~$15,000/month).
  • Notifications:
    • SNS/CloudWatch Events: Free (charges for SNS delivery, e.g., $0.02/1,000 emails).
  • Example:
    • Business Support plan, 1,000 SNS email notifications:
      • Trusted Advisor: $0 (included in Business Support).
      • SNS: 1,000 × $0.02/1,000 = $0.02.
      • Total: $0.02/month (plus Business Support cost).
  • Free Tier: 7 free checks for all AWS users.

Cost Optimization Benefits#

  • Identify Savings:
    • Cost Optimization checks find unused resources (e.g., idle EC2, unattached EBS).
    • Explanation: E.g., delete idle EC2 to save $50/month.
  • Enhanced Recommendations:
    • ML-driven insights for cost savings (2024).
    • Explanation: E.g., recommend Savings Plans for EC2 to save 20% ($200/month).
  • Prioritize Actions:
    • Focus on high-impact recommendations (Business/Enterprise).
    • Explanation: E.g., prioritize deleting 10 unattached EBS volumes to save $100/month.

Cost Strategies#

  • Use Free Checks:
    • Leverage 7 free checks for basic cost and security optimization.
    • Explanation: E.g., check S3 permissions to avoid premium plan.
  • Automate Actions:
    • Use CloudWatch Events/Lambda to act on recommendations (e.g., stop idle EC2).
    • Explanation: E.g., automate EC2 termination to save $50/month.
  • Suppress Noise:
    • Exclude intentional configurations to reduce manual reviews.
    • Explanation: E.g., exclude public S3 bucket to save admin time.
  • Tagging:
    • Tag resources for cost allocation, align with Trusted Advisor checks.
    • Explanation: E.g., tag EC2 with “Project:App” for tracking.
  • Monitor Costs:
    • Use Cost Explorer to track savings from Trusted Advisor actions.
    • Explanation: E.g., verify $300/month savings from recommendations.

Key Notes:#

  • Cost Savings: Free checks + automated actions + ML insights = lower costs.
  • Exam Tip: Calculate savings from Cost Optimization checks.

6. Trusted Advisor Advanced Features#

Enhanced Recommendations:#

  • Purpose: Smarter insights.
  • Features:
    • ML-driven recommendations for cost, security, and performance (2024).
    • Explanation: E.g., suggest right-sizing EC2 based on usage patterns.
  • Exam Tip: Know for advanced optimization.

Security Hub Integration:#

  • Purpose: Centralized compliance.
  • Features:
    • Aggregates Trusted Advisor security findings with GuardDuty, Inspector (2025).
    • Explanation: E.g., flag open security group in Security Hub.
  • Exam Tip: Use for compliance monitoring.

Cross-Account Support:#

  • Purpose: Enterprise visibility.
  • Features:
    • Aggregates recommendations across AWS Organizations (2024).
    • Explanation: E.g., view cost checks for 50 accounts.
  • Exam Tip: Know for multi-account environments.

Trusted Advisor Priority:#

  • Purpose: Focus on critical issues.
  • Features:
    • Curated recommendations for Business/Enterprise plans.
    • Explanation: E.g., prioritize fixing exposed IAM keys.
  • Exam Tip: Use for high-impact actions.

API and Automation:#

  • Purpose: Programmatic access.
  • Features:
    • API for refreshing checks, retrieving results, and excluding items.
    • Integrates with Lambda, EventBridge for automation.
    • Explanation: E.g., Lambda deletes idle EBS volumes on yellow check.
  • Exam Tip: Know for automation workflows.

Key Notes:#

  • Flexibility: ML recommendations + Security Hub + cross-account = advanced optimization.
  • Exam Tip: Master Security Hub integration and API automation.

7. Trusted Advisor Use Cases#

Understand practical applications.

Cost Optimization#

  • Setup: Cost Optimization checks, SNS notifications.
  • Features: Identify unused resources, suggest Savings Plans.
  • Explanation: E.g., delete 5 idle EC2 instances to save $250/month.

Security Hardening#

  • Setup: Security checks, Security Hub integration.
  • Features: Detect open S3 buckets, disabled MFA.
  • Explanation: E.g., restrict public S3 bucket for compliance.

Resilience Improvement#

  • Setup: Fault Tolerance checks, Lambda automation.
  • Features: Ensure Multi-AZ, Auto Scaling.
  • Explanation: E.g., enable Multi-AZ for RDS for HA.

Performance Optimization#

  • Setup: Performance checks, CloudWatch Events.
  • Features: Optimize EC2, RDS sizing.
  • Explanation: E.g., right-size EC2 to improve latency and save $100/month.

8. Trusted Advisor vs. Other Compliance Tools#

FeatureTrusted AdvisorAWS ConfigSecurity Hub
TypeBest Practice ChecksConfiguration ComplianceSecurity Monitoring
FocusCost, security, resilienceResource configurationsSecurity findings
DataRecommendationsConfiguration changesGuardDuty, Inspector
CostFree–Business/Enterprise$0.003/100 evaluations$0.001/finding
Use CaseOptimize EC2 costsTrack S3 bucket changesMonitor security threats

Explanation:#

  • Trusted Advisor: Broad best practice recommendations.
  • AWS Config: Tracks configuration changes and compliance.
  • Security Hub: Centralizes security findings.

9. Detailed Explanations for Mastery#

  • Enhanced Recommendations:
    • Example: Suggest Savings Plans for EC2 based on usage.
    • Why It Matters: Smarter cost/security insights (2024).
  • Security Hub Integration:
    • Example: Flag open security group in Security Hub.
    • Why It Matters: Centralized compliance (2025).
  • Cross-Account Support:
    • Example: View recommendations for 100 accounts.
    • Why It Matters: Enterprise visibility (2024).

10. Quick Reference Table#

FeaturePurposeKey DetailExam Relevance
ChecksEvaluate best practicesCost, security, resilience, etc.Core Concept
RecommendationsActionable suggestionsRed, yellow, green severityCore Concept
Free ChecksBasic optimization7 checks (e.g., S3 permissions)Core Concept
Cross-AccountMulti-account visibilityAWS Organizations support (2024)Scalability
Security HubCompliance monitoringSecurity findings (2025)Security, Resilience
NotificationsAlert on issuesCloudWatch Events, SNSFlexibility
PriorityHigh-impact actionsBusiness/Enterprise plansFlexibility

Found an issue? Improve this note in the GitHub repo.