AWS Trusted Advisor
Automated best-practice inspector that scans your account and flags cost, security, performance, fault tolerance, and quota issues.
Verified against AWS documentation · 2026-08-27
Key facts
- 01Checks your account against AWS best practices across five exam pillars: cost optimization, performance, security, fault tolerance, service limits
- 02Findings are color-coded: red = act now, yellow = investigate, green = fine
- 03All accounts get a core set of checks (service limits + select security); the full check library requires a paid support plan
- 04It recommends, it doesn't fix — remediation is on you (or automation you wire up via EventBridge)
- 05Organizational View aggregates findings across all accounts in an AWS Organization from the management account
Exam triggers
Phrases and scenarios that point here.
- "Best practice recommendations" or "identify idle/underutilized resources" → Trusted Advisor
- "Check if security groups allow unrestricted access" or "MFA on root" as an automated account-wide scan → Trusted Advisor
- "Approaching service limits/quotas" and want alerts → Trusted Advisor (limit checks are free-tier)
- "Which support plan is needed for all Trusted Advisor checks" → Business-level support or higher
Not this service
- Continuous resource config compliance against your own rules → AWS Config
- Detailed cost analysis and spend breakdowns → Cost Explorer
- Threat detection from logs and network activity → GuardDuty
- Architecture review of a specific workload against the framework → Well-Architected Tool
Use cases
- 01Monthly hygiene sweep — catching the Elastic IP someone allocated for a demo and never released, still billing quietly
- 02Pre-launch check that no security group has port 22 open to 0.0.0.0/0 before an audit
- 03Wiring limit checks to EventBridge so you get a Slack ping before you hit the EC2 instance quota during a scaling event, not after
- 04Central cloud team using Organizational View to spot which of 40 member accounts have public S3 buckets without logging into each one
How it's charged
- 01No charge for Trusted Advisor itself — access is gated by your support plan, not billed per check
- 02Core checks (service limits + select security) are free on every account; the full check library requires a Business-level support plan or higher
- 03Support plans are billed as a monthly minimum or a percentage of your AWS spend, whichever is greater
