Skip to content

AWS Trusted Advisor

Trusted Advisor is a managed best-practice auditing service. It inspects an AWS account and makes recommendations where there is an opportunity to save money, improve availability or performance, or close a security gap. It needs no agent and no configuration — it works at the account level using the account’s own data.

There are six:

CategoryWhat it looks for
Cost optimizationIdle and under-used resources, Reserved Instance and Savings Plans opportunities.
PerformanceConfiguration that limits throughput or responsiveness — over-utilised instances, missing CloudFront optimisations.
SecurityWeak configuration: public snapshots, open security groups, missing MFA on the root user.
Fault toleranceSingle points of failure — missing backups, resources in one Availability Zone.
Service limitsUsage approaching a service quota, before it becomes an incident.
Operational excellenceOperational debt such as deprecated Lambda runtimes and CloudFormation stack drift.
  • Basic Support (and, until it is withdrawn, Developer Support) gives console access to every check in the Service limits category plus a named subset of Security and Fault tolerance checks — public EBS and RDS snapshots, S3 bucket permissions, MFA on the root account, security groups with specific ports unrestricted, and STS global endpoint usage. Checks are not refreshed automatically at this tier; you refresh them by hand in the console.
  • AWS Business Support+, AWS Enterprise Support and AWS Unified Operations give every check, plus the Trusted Advisor API and the CLI, plus EventBridge events on check status so results can be pulled into a monitoring pipeline instead of read off a dashboard.
  • Organizational view aggregates check results across every account in an AWS organization, which is the only sane way to read it once you have more than a handful of accounts.
  • Trusted Advisor Priority surfaces prioritised, AWS-curated recommendations for Enterprise Support customers.
  • Trusted Advisor also displays checks powered by AWS Config and controls from AWS Security Hub CSPM, so it is increasingly a front end onto other services rather than a separate engine.
  • Opting in to AWS Compute Optimizer adds its rightsizing findings to the Trusted Advisor cost optimization category. See AWS Compute Optimizer.

The set of checks changes several times a year. Treat the AWS check reference as the source of truth rather than any list transcribed into a document.