AWS Trusted Advisor is an automated service that provides proactive recommendations to help customers optimize their cloud environments based on AWS best practices. The service provides actionable guidance to help users stay ahead of risks related to availability, security, and infrastructure costs.
- AWS Trusted Advisor acts as a built-in expert that scans your AWS account to identify potential issues before they impact operations.
- The service provides specific, actionable recommendations across five pillars: cost optimization, performance, security, fault tolerance, and service limits.
- It continuously analyzes your AWS resources to ensure your environment remains aligned with established AWS best practices.
Architecture of AWS Trusted Advisor
AWS Trusted Advisor operates as a centralized advisory engine that continuously evaluates your AWS account against AWS best practices. It integrates natively with AWS internal control planes and service metadata to analyze resource configurations, usage patterns, and account-level settings.
At a high level, AWS Trusted Advisor consists of:
- A collection of predefined checks aligned with AWS best practices
- Read-only access to your AWS account metadata and configurations
- A recommendation engine that evaluates findings across five categories: cost optimization, security, fault tolerance, performance, and service limits
- Multiple access interfaces including the AWS Management Console, APIs, and event-based integrations
Trusted Advisor does not modify resources directly. Instead, it provides insights and recommendations that customers can review or automate remediation for.
Trusted Advisor Working
Step 1: Data Collection
Trusted Advisor continuously gathers metadata from supported AWS services such as EC2, S3, IAM, RDS, and VPC. This data includes configuration details, usage metrics, and account-level limits. No application code or customer data is accessed.
Step 2: Best Practice Evaluation
The collected data is evaluated against a predefined set of AWS best-practice rules. Each rule represents a specific check, such as identifying idle resources, insecure configurations, or single points of failure.
Step 3: Check Execution and Status
Each check is evaluated and marked with a status:
- Green – No issues detected
- Yellow – Investigation recommended
- Red – Immediate action recommended
Step 4: Recommendation Generation
For checks that fail or require attention, Trusted Advisor generates actionable recommendations. These include a description of the issue, affected resources, potential risks, and suggested remediation steps.
Step 5: Presentation and Access
Results are presented through:
- The AWS Management Console for visual analysis.
- The Trusted Advisor API for programmatic access.
- Amazon EventBridge for event-driven automation.
- AWS Lambda for automated remediation workflows.
Step 6: Refresh and Update Cycle
The frequency at which checks are refreshed depends on the AWS Support Plan. Business and Enterprise plans provide more frequent refreshes and access to a broader set of checks.
Example Workflow
A typical Trusted Advisor workflow look like this:
- Trusted Advisor detects an idle EC2 instance under Cost Optimization.
- The finding appears as a Red alert in the dashboard.
- An EventBridge rule captures the update.
- A Lambda function is triggered to notify the team or automatically stop the idle instance.
Core Categories of Trusted Advisor Checks
Cost Optimization
Trusted Advisor identifies opportunities to reduce unnecessary spending by highlighting idle or underutilized resources.
Examples include:
- Idle EC2 instances
- Unattached EBS volumes
- Underutilized load balancers
- Low-utilization Reserved Instances
These recommendations help organizations eliminate waste and improve overall cost efficiency.
Security
Security checks focus on identifying configurations that may expose AWS resources to potential threats.
Examples include:
- S3 buckets with public access
- IAM users with overly permissive policies
- Security groups allowing unrestricted access (e.g., open SSH ports)
- Lack of MFA on root accounts
These checks help enforce the principle of least privilege and strengthen the security posture.
Fault Tolerance
Fault tolerance checks ensure that applications are designed to remain available during failures.
Examples include:
- EC2 instances not using Auto Scaling groups
- Lack of Multi-AZ deployments for databases
- Single points of failure in architecture
By addressing these findings, systems become more resilient to outages and infrastructure failures.
Performance
Performance checks analyze whether resources are configured optimally to meet workload demands.
Examples include:
- EC2 instances experiencing high CPU utilization
- Suboptimal load balancer configurations
- Missing caching layers where appropriate
These insights help maintain consistent performance and responsiveness.
Service Limits
AWS enforces service quotas to protect system stability. Trusted Advisor monitors usage against these limits.
Examples include:
- Approaching EC2 instance limits
- Near-capacity Elastic IP usage
- VPC or security group quota exhaustion
Proactive monitoring helps prevent deployment failures caused by hitting service limits.
Trusted Advisor Checks and Support Plans
The number and depth of Trusted Advisor checks depend on your AWS Support Plan:
Basic & Developer Support
- Access to a limited set of security and service limit checks
Business & Enterprise Support
- Full access to all Trusted Advisor checks
- Near real-time refresh
- API access for automation
This makes Trusted Advisor particularly powerful for production and enterprise workloads.
Benefits of AWS Trusted Advisor
- Proactively identifies risks before they impact production.
- Improves cost efficiency by eliminating waste.
- Strengthens security and compliance posture.
- Enhances system reliability and availability.
- Reduces manual effort through automation.
Limitations of AWS Trusted Advisor
While powerful, Trusted Advisor has some limitations:
- Full functionality requires Business or Enterprise support plans.
- Recommendations are generic and may need contextual evaluation.
- Does not replace architectural reviews or human judgment.
