AWS Trusted Advisor
Automated account optimization advice
Scans your AWS account and gives recommendations in these categories: cost optimization, performance, security, fault tolerance, service limits, and operational excellence.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Serverless
- In examsCLF · SAA · SOA
Think of it asLike a doctor giving your AWS account a regular checkup, with a list of things to fix.
When to use it
✓ Use it when
You want to quickly find wasted resources, basic security gaps, or limits you're about to hit.
✗ Avoid it when
Need threat detection or detailed continuous compliance checks → GuardDuty / Security Hub / Config.
Common uses
- Find idle EC2 instances and unattached EBS volumes
- Alert on public S3 buckets and security groups open to 0.0.0.0/0
- Track service limits that are nearly full
What does it cost?
- Pricing model: The core set of checks is free; the full set comes with AWS Support Business plans and higher.
A common CLF exam question: getting every check requires a Business/Enterprise Support plan.
When the question asks for automated recommendations on cost, basic security and service limits across the account, choose Trusted Advisor (full checks need Business or Enterprise Support); for metric-based instance right-sizing, Compute Optimizer; for threat detection, GuardDuty.
Frequently asked questions
How is Trusted Advisor different from Compute Optimizer and Cost Explorer?
Trusted Advisor scans the whole account across categories (cost, security, fault tolerance, performance, service limits) and gives a list of things to fix. Compute Optimizer goes deeper on right-sizing EC2, EBS, Lambda and more based on usage metrics. Cost Explorer lets you view and analyze spending over time and does not recommend configuration changes.
Is Trusted Advisor free, and can I see all checks?
Which checks you can see depends on your AWS Support plan. Basic and Developer plans get only a core set, mainly security and service limits. Business and above get all checks in every category, plus an API and EventBridge integration for automatic alerts.
What security checks does Trusted Advisor run?
Examples: security groups open too widely, publicly accessible S3 buckets, root account without MFA, public EBS or RDS snapshots, and IAM not used properly. It is a quick scan for basic mistakes and does not replace threat detection such as GuardDuty.
Related services
SAA-C03 study guide
Trusted Advisor is covered in these study modules: