AWS: Trusted Advisor, part 1 — its features overview
Tags: aws, security, devops, todayilearned
Published: 2021-11-30 09:01:27

---
title: AWS: Trusted Advisor, part 1 — its features overview
published: true
date: 2021-11-29 08:15:23 UTC
tags: aws,security,devops,todayilearned
canonical_url: https://rtfm.co.ua/en/aws-trusted-advisor-part-1-its-features-overview/
---

### AWS: Trusted Advisor, part 1  - features overview

![](https://cdn-images-1.medium.com/max/290/1*IQXKQuuiBB-kvKYDCUSuiQ.png)

AWS Trusted Advisor is another service that allows monitoring your accountant its resources in use for their cost-effectiveness, performance, security, and more.

Keep in mind, that Trusted Advisor’s checks that are available for you depend on the [AWS Support Plan](https://aws.amazon.com/premiumsupport/plans/) of your account. вашего аккаунта. Fortunately, we have Premium so I’m able to how all Trusted Advisor’s features.

Check its general documentation on the [AWS Trusted Advisor check reference page](https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-check-reference.html), and documentation about its checks here — [AWS Trusted Advisor check reference](https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-check-reference.html#cost-optimization-checks).

- [Cost optimization](https://rtfm.co.ua/en/aws-trusted-advisor-part-1-its-features-overview/#Cost_optimization)
- [Performance](https://rtfm.co.ua/en/aws-trusted-advisor-part-1-its-features-overview/#Performance)
- [Security](https://rtfm.co.ua/en/aws-trusted-advisor-part-1-its-features-overview/#Security)
- [How can I find a resource that is using a specific AWS SecurityGroup?](https://rtfm.co.ua/en/aws-trusted-advisor-part-1-its-features-overview/#How_can_I_find_a_resource_that_is_using_a_specific_AWS_SecurityGroup)
- [Fault tolerance](https://rtfm.co.ua/en/aws-trusted-advisor-part-1-its-features-overview/#Fault_tolerance)
- [Service limits](https://rtfm.co.ua/en/aws-trusted-advisor-part-1-its-features-overview/#Service_limits)
- [Preferences](https://rtfm.co.ua/en/aws-trusted-advisor-part-1-its-features-overview/#Preferences)

Go to the _AWS Console > Trusted Advisor_, enable it, and you’ll see a dashboard with its recommendations:

![](https://cdn-images-1.medium.com/max/1024/0*lCTvntORs6vrbqj9.png)

Here:

- **Action recommended** : Trusted Advisor believes that you have to pay attention asap as there is something serious, for example — a leak of an IAM key
- **Investigation recommended** : Trusted Advisor believes, that you have to pay attention to check some services, for example when you’re about some AWS service’s quotes
- **Excluded items** : well — just exclusions

And on the left side, you’ll see its categories — cost optimization, performance, and so on, where all checks are grouped.

#### Cost optimization

Let’s start from the _Cost optimization_ category, as it’s the most interesting for me now.

Go to the category and you’ll see a list of findings:

![](https://cdn-images-1.medium.com/max/1024/0*4Q5rID63m-4vfzcu.png)

For example, let’s examine the [_Amazon RDS Idle DB Instances_](https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-check-reference.html#amazon-rds-idle-dbs-instances)check_:_

![](https://cdn-images-1.medium.com/max/1024/0*9KNUwyebb4z_2O_d.png)

So, here we can see that Trusted Advisor found some RDS servers that are not being used.

Go to check on of them:

![](https://cdn-images-1.medium.com/max/1024/0*K2fvuEgTmuJBCOh4.png)

Indeed, the server has had no CPU load, and even no connection for the last week, so it’s good to point to delete it or downgrade to a cheaper instance type.

Similar findings for the EC2 service:

![](https://cdn-images-1.medium.com/max/1024/0*v3IQeAfvwHlv-Aes.png)

#### Performance

Just what it sounds like, here are finding of everything that possibly affects the performance of your AWS services used:

![](https://cdn-images-1.medium.com/max/1024/0*6BJQFh-iis8u-rMl.png)

For example, let’s take a look at the _Large Number of EC2 Security Group Rules Applied to an Instance_ check:

![](https://cdn-images-1.medium.com/max/1024/0*_teSfrDTz_gwiYh9.png)

Will be interesting to run some performance tests using different Security Groups.

#### Security

And the very interesting part is the _Security_:

![](https://cdn-images-1.medium.com/max/1024/0*89hxg1JHKw10alox.png)

Expected for me, we have a notification that our IAM keys are not being rotated, and it’s a good point to review.

Also, a helpful check is the _Security Groups — Unrestricted Access_:

![](https://cdn-images-1.medium.com/max/1024/0*YME0RqjNkuX2f8KU.png)

And really — there is a SecurityGroup (SG) with full access to the Internet:

![](https://cdn-images-1.medium.com/max/1024/0*Mpc1onEcRQKnoRZj.png)

#### How can I find a resource that is using a specific AWS SecurityGroup?

Copy a group’s ID группы, go to the _EC2 >_ _Network Interfaces_, and look for interfaces by using this ID:

![](https://cdn-images-1.medium.com/max/1024/0*HBzRQ9ZOZXJ-_PQX.png)

On the right side, you can see an _Instance ID_ which has this ENI (AWS Elastic network Interface) attached and, respectfully, the SecurityGroup used.

In case of the “_No matching network interfaces found_” error, the SG isn’t attached to any resources and thus can be removed.

Also, a good check is about LoadBalancer Listeners, that haven’t SSL configured:

![](https://cdn-images-1.medium.com/max/1024/0*BAR6Obo0B6Yoyl81.png)

#### Fault tolerance

Here we have findings, that are related to your resources stability:

![](https://cdn-images-1.medium.com/max/1024/0*pZNla26YsamEjRtV.png)

For example, we have some RDS servers deployed as a Single-AZ instead of being deployed to a few data centers:

![](https://cdn-images-1.medium.com/max/1024/0*CKFlnJWYIhmfWRW3.png)

#### Service limits

And the last category is the _Service limits_, where you can find notifications about AWS Quotes that soon can be reached or are already reached:

![](https://cdn-images-1.medium.com/max/983/0*0U5F7F3rPXAC3zEg.png)

In the case of the VPC service quotas, now we are warned that we will not be able to create a new AWS VPC in the _us-east-1_ region:

![](https://cdn-images-1.medium.com/max/1024/0*4IB6_fRZe5TwfQ3X.png)

#### Preferences

In the Preferences you can configure emails to be sent with the latest findings:

![](https://cdn-images-1.medium.com/max/804/0*H7VcnoBWrkeQGsYU.png)

Also, for the monitoring purpose, you can configure AWS CloudWatch Alarms, and send its notifications to a Slack channel.

Read more bout this in the second part of this post — [AWS: Trusted Advisor, part 2 — CloudWatch Alarms and Slack notifications](https://rtfm.co.ua/en/?p=27384).

_Originally published at_ [_RTFM: Linux, DevOps, and system administration_](https://rtfm.co.ua/en/aws-trusted-advisor-part-1-its-features-overview/)_._

* * *