AWS Trusted Advisor
Best-practice checks across your AWS account: the six check categories, which checks each support plan includes, the 2027 support plan changes, organizational view, Trusted Advisor Priority, automation with EventBridge, and how Trusted Advisor differs from Compute Optimizer, Config, and Security Hub.
3 min read · Last reviewed · SAA-C03
Sign in to bookmark tutorials and track what you have read.
On this page
What it is
AWS Trusted Advisor inspects your AWS environment and makes recommendations where you can save money, improve availability and performance, or close security gaps. It draws on best practices learned from serving many AWS customers.
Choose Trusted Advisor when a question asks for automated best-practice checks across an account, such as idle resources, open Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry ports, missing MFA (Multi-factor authentication)Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.Glossary entry on the root user, public snapshots, or resources close to their service quotas.
Check categories
Trusted Advisor groups its checks into six categories:
- Cost optimization: for example idle or underused resources, and reservations that could save money.
- Performance.
- Security: for example security groups with unrestricted ports, S3 bucket permissions, public EBS and RDS snapshots, and MFA on the root account.
- Fault toleranceThe ability of a system to keep working without interruption when a component fails, because enough redundant capacity is already running. It goes further than high availability, which may allow a short failover.Glossary entry.
- Service limits: resources approaching their service quotas.
- Operational excellence.
Which checks you get
- With the Basic support plan (and Developer Support), you get all checks in the Service limits category and a selected set of Security and Fault tolerance checks, such as public EBS and RDS snapshots, S3 bucket permissions, and root MFA. You must refresh Security checks manually.
- With Business Support+, Enterprise Support, or Unified Operations, you get all checks, the Trusted Advisor API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, and check results through EventBridge.
Support plan changes
AWS is changing its support plans on January 1, 2027:
- Developer Support and Business Support are being discontinued in favor of Business Support+.
- Enterprise On-Ramp is being discontinued. Its customers are moved to Enterprise Support, which now has a lower minimum price.
Older exam material says "Business or Enterprise Support unlocks all Trusted Advisor checks". The idea is the same: full checks need a paid plan above Developer.
Features to know
- Organizational view: reports of Trusted Advisor checks across all accounts in AWS Organizations.
- Trusted Advisor Priority: your AWS account team monitors your account and creates prioritized recommendations, for example when the root user has no MFA.
- Automation: send check results to EventBridge to notify teams or trigger fixes.
- Some checks are powered by AWS Config, Security Hub, and Compute Optimizer.
Trusted Advisor or another option?
| If the requirement is | Choose |
|---|---|
| Broad best-practice checks across cost, security, fault tolerance, and limits | AWS Trusted Advisor |
| Know when resources approach service quotas | Trusted Advisor service limits checks, or Service Quotas |
| Detailed right-sizing based on usage | AWS Compute Optimizer |
| Custom configuration compliance rules | AWS Config |
| Security posture against standards such as CIS | AWS Security Hub |
| Structured review of a workload's architecture | AWS Well-Architected Tool |
Reverse mindmap: when the question points here
- Yes, when the question says
- Best-practice recommendations for the account leads to Trusted Advisor
- Find idle or underused resources to cut cost leads to Trusted Advisor cost checks
- Security groups open to the world leads to Trusted Advisor security checks
- Resources close to service limits leads to Trusted Advisor service limits
- Know the access
- All checks and the API leads to Business Support+ or Enterprise Support
- Basic plan leads to Service limits plus a few security checks
- Checks across all accounts leads to Organizational view
- Automate on a failed check leads to EventBridge rule
- No, when the question says
- Exact right-size recommendation for an instance leads to Compute Optimizer
- Our own compliance rules leads to Config
Key takeaways
- Trusted Advisor checks cost optimization, performance, security, fault tolerance, service limits, and operational excellence.
- Basic and Developer plans include service limits checks and a few security and fault tolerance checks; Business Support+, Enterprise, and Unified Operations include all checks, the API, and EventBridge.
- Developer, Business, and Enterprise On-Ramp support plans end on January 1, 2027.
- Organizational view covers all accounts; Trusted Advisor Priority adds recommendations from your account team.
Sources
- AWS Support User Guide: AWS Trusted Advisor
- AWS Support User Guide: AWS Trusted Advisor check reference
- AWS Support User Guide: Organizational view for AWS Trusted Advisor
- AWS Support User Guide: Get started with AWS Trusted Advisor Priority
- AWS Support User Guide: Monitoring Trusted Advisor check results with Amazon EventBridge
- AWS Support User Guide: Developer, Business, and Enterprise On-Ramp end of support