Trusted Advisor

AWS Trusted Advisor is an automated best-practices advisor for your account. It continuously inspects your AWS environment and produces a checklist of recommendations — where you could save money, tighten security, improve reliability, boost performance, or where you're approaching a service limit.

Think of it as a health check for your whole AWS account that runs on its own and tells you what to fix.

What It Looks At

Trusted Advisor groups its checks into five categories:

• Cost optimization — idle or underused resources you're paying for
• Performance — configurations that could run faster
• Security — open security groups, public S3 buckets, root account without MFA, exposed keys
• Fault tolerance — missing backups, single-AZ setups, no Multi-AZ
• Service limits — resources approaching an account quota

The One Thing to Internalize: It Only Advises

Trusted Advisor never changes anything. It detects and recommends — the actual fixing is up to you (or your automation). This puts it in the same family as AWS's other "detector" services: it produces findings, and acting on them is a separate step.

The Catch: Your Support Plan Decides What You Get

This is the detail the exam cares about most. On Basic or Developer support, you only get a limited set of checks (core security + service quotas). To get all the checks — and, crucially, to automate anything with the Trusted Advisor API, CloudWatch metrics, or EventBridge — you need a Business or Enterprise support plan.