AWS Trusted Advisor
Trusted Advisor is a managed best-practice auditing service. It inspects an AWS account and makes recommendations where there is an opportunity to save money, improve availability or performance, or close a security gap. It needs no agent and no configuration — it works at the account level using the account’s own data.
Check categories
Section titled “Check categories”There are six:
| Category | What it looks for |
|---|---|
| Cost optimization | Idle and under-used resources, Reserved Instance and Savings Plans opportunities. |
| Performance | Configuration that limits throughput or responsiveness — over-utilised instances, missing CloudFront optimisations. |
| Security | Weak configuration: public snapshots, open security groups, missing MFA on the root user. |
| Fault tolerance | Single points of failure — missing backups, resources in one Availability Zone. |
| Service limits | Usage approaching a service quota, before it becomes an incident. |
| Operational excellence | Operational debt such as deprecated Lambda runtimes and CloudFormation stack drift. |
What each support plan gets
Section titled “What each support plan gets”- Basic Support (and, until it is withdrawn, Developer Support) gives console access to every check in the Service limits category plus a named subset of Security and Fault tolerance checks — public EBS and RDS snapshots, S3 bucket permissions, MFA on the root account, security groups with specific ports unrestricted, and STS global endpoint usage. Checks are not refreshed automatically at this tier; you refresh them by hand in the console.
- AWS Business Support+, AWS Enterprise Support and AWS Unified Operations give every check, plus the Trusted Advisor API and the CLI, plus EventBridge events on check status so results can be pulled into a monitoring pipeline instead of read off a dashboard.
Beyond the dashboard
Section titled “Beyond the dashboard”- Organizational view aggregates check results across every account in an AWS organization, which is the only sane way to read it once you have more than a handful of accounts.
- Trusted Advisor Priority surfaces prioritised, AWS-curated recommendations for Enterprise Support customers.
- Trusted Advisor also displays checks powered by AWS Config and controls from AWS Security Hub CSPM, so it is increasingly a front end onto other services rather than a separate engine.
- Opting in to AWS Compute Optimizer adds its rightsizing findings to the Trusted Advisor cost optimization category. See AWS Compute Optimizer.
The set of checks changes several times a year. Treat the AWS check reference as the source of truth rather than any list transcribed into a document.