Trusted Advisor Recommendations
Key concepts
Cost optimization checks
Underutilized resources
Idle load balancers
Unassociated Elastic IPs
Business/Enterprise support
Overview
AWS Trusted Advisor is an automated best practices auditing tool that analyzes your AWS environment and provides recommendations across five categories: Cost Optimization, Performance, Security, Fault Tolerance, and Service Limits. For the SAA-C03 exam, understanding how Trusted Advisor identifies cost optimization opportunities—particularly around underutilized and idle resources—is essential for architecting cost-effective solutions.
Trusted Advisor Access Tiers
Trusted Advisor checks are divided by support tier. Basic and Developer support tiers get only 6 core security checks (S3 bucket permissions, Security Groups, IAM use, MFA, EBS snapshots, RDS snapshots). Business, Enterprise On-Ramp, and Enterprise support tiers unlock ALL 100+ checks including crucial cost optimization recommendations for idle load balancers, underutilized EC2 instances, unassociated Elastic IPs, and more.
When exam questions ask about identifying underutilized resources, idle load balancers, or unassociated Elastic IPs, Trusted Advisor is typically the answer—but remember that cost optimization checks require Business or Enterprise support tier. For automated remediation, combine Trusted Advisor with EventBridge and Lambda.
Key Concepts
Trusted Advisor Categories
Cost Optimization Checks
Purpose: Identify opportunities to reduce AWS spending
Key Checks for SAA-C03: | Check | What It Identifies | |-------|-------------------| | Idle Load Balancers | ELBs with no registered instances or minimal traffic | | Underutilized EC2 Instances | Instances with <10% average CPU over 14 days | | Unassociated Elastic IPs | EIPs not attached to running instances ($0.005/hour) | | Idle RDS DB Instances | Databases with no connections for 7+ days | | Underutilized EBS Volumes | Volumes with very low read/write activity | | Reserved Instance Optimization | Recommendations for RI purchases | | S3 Incomplete Multipart Uploads | Failed uploads consuming storage | | Route 53 Latency Resource Record Sets | Misconfigured latency routing |
Support Tier: Business, Enterprise On-Ramp, Enterprise
Performance Checks
Purpose: Improve application speed and responsiveness
Key Checks: | Check | What It Identifies | |-------|-------------------| | High Utilization EC2 Instances | Instances averaging >90% CPU | | CloudFront Content Delivery | Optimization opportunities | | CloudFront Header Forwarding | Unnecessary header forwarding reducing cache hit ratio | | CloudFront Alternate Domain Names | CNAMEs that could improve performance | | EC2 Security Groups: Large Number of Rules | Security groups with excessive rules |
Support Tier: Business, Enterprise On-Ramp, Enterprise
Security Checks
Purpose: Identify security vulnerabilities and improve security posture
Free Checks (All Support Tiers): | Check | What It Identifies | |-------|-------------------| | S3 Bucket Permissions | Buckets with public access | | Security Groups - Specific Ports Unrestricted | Risky open ports (22, 3389, etc.) | | IAM Use | Whether IAM users have been created | | MFA on Root Account | Root account MFA status | | EBS Public Snapshots | Publicly accessible EBS snapshots | | RDS Public Snapshots | Publicly accessible RDS snapshots |
Additional Checks (Business/Enterprise):
- IAM Access Key Rotation
- Exposed Access Keys
- CloudTrail Logging
- ELB Security Groups
Fault Tolerance Checks
Purpose: Improve availability and redundancy
Key Checks: | Check | What It Identifies | |-------|-------------------| | Amazon RDS Multi-AZ | RDS instances without Multi-AZ enabled | | EC2 Availability Zone Balance | Uneven instance distribution across AZs | | Load Balancer Optimization | Load balancers with uneven instance counts | | VPN Tunnel Redundancy | VPN connections with single tunnel | | Auto Scaling Group Resources | ASG configuration issues | | EBS Snapshots | Volumes without recent snapshots |
Support Tier: Business, Enterprise On-Ramp, Enterprise
Service Limits Checks
Purpose: Monitor approaching AWS service quotas
Key Checks: | Service | Default Limits Monitored | |---------|-------------------------| | VPCs per Region | 5 (soft limit) | | Elastic IPs per Region | 5 (soft limit) | | Auto Scaling Groups | 200 per region | | CloudFormation Stacks | 200 per region | | EBS Snapshots | Volume-based limits | | IAM Server Certificates | 20 per account |
Alert Threshold: Warning when usage exceeds 80% of limit
Support Tier: Business, Enterprise On-Ramp, Enterprise
Support Tier Requirements
Trusted Advisor Access by Support Plan
| Support Plan | Cost | Cost Optimization | Performance | Security | Fault Tolerance | Service Limits |
|---|---|---|---|---|---|---|
| Basic | Free | None | None | 6 Core Checks | None | None |
| Developer | From $29/month | None | None | 6 Core Checks | None | None |
| Business | From $100/month or 10% of AWS spend | All Checks | All Checks | All Checks | All Checks | All Checks |
| Enterprise On-Ramp | From $5,500/month | All Checks | All Checks | All Checks | All Checks | All Checks |
| Enterprise | From $15,000/month | All Checks | All Checks | All Checks | All Checks | All Checks |
Cost Optimization Deep Dive
Idle Load Balancers
What Trusted Advisor Checks:
- Classic Load Balancers with no registered instances
- Load Balancers with request count < 100 over last 7 days
- Load Balancers with no healthy instances
Cost Impact: | Load Balancer Type | Idle Cost/Month | |-------------------|-----------------| | Classic LB | ~$18/month | | Application LB | ~$22.50/month (minimum) | | Network LB | ~$22.50/month (minimum) | | Gateway LB | ~$22.50/month (minimum) |
Common Causes:
- Decommissioned applications
- Failed deployments (instances terminated, LB remains)
- Development/test resources not cleaned up
- Auto Scaling groups scaled to zero
Remediation: Delete unused load balancers, implement cleanup automation
Unassociated Elastic IPs
What Trusted Advisor Checks:
- Elastic IP addresses not associated with running EC2 instances
- EIPs associated with stopped instances
- EIPs associated with unattached network interfaces
Cost Impact: | Status | Cost | |--------|------| | Associated with running instance | FREE | | Not associated (idle) | $0.005/hour (~$3.60/month) | | Associated with stopped instance | $0.005/hour (~$3.60/month) | | Additional EIP per running instance | $0.005/hour |
Common Causes:
- Instance terminated but EIP not released
- Instance stopped for extended period
- Network interface detached from instance
- Reserved for future use but never utilized
Remediation: Release unused EIPs, attach to instances, or automate cleanup
Underutilized EC2 Instances
What Trusted Advisor Checks:
- Average CPU utilization < 10% over last 14 days
- Network I/O consistently low
- Instances that could be right-sized to smaller types
Estimated Savings Calculation:
Current: m5.xlarge at $0.192/hour = $140.16/month
Recommended: m5.large at $0.096/hour = $70.08/month
Monthly Savings: $70.08 (50%)
Considerations Before Action:
- Check for periodic batch workloads (might spike occasionally)
- Verify instance sizing for burst traffic
- Review memory utilization (CloudWatch agent required)
- Consider Savings Plans or Reserved Instances first
Remediation: Right-size instances, consider T-series for variable workloads
Idle RDS DB Instances
What Trusted Advisor Checks:
- RDS instances with 0 connections for 7+ consecutive days
- Very low read/write I/O operations
- No recent queries executed
Cost Impact: | Instance Type | Idle Cost/Month | |--------------|-----------------| | db.t3.micro | ~$12/month | | db.t3.medium | ~$48/month | | db.m5.large | ~$125/month | | db.r5.xlarge | ~$360/month |
Plus ongoing costs:
- Storage charges continue
- Backup storage charges
- Multi-AZ doubles cost even when idle
Remediation: Delete unused databases, take final snapshot, stop if temporarily unused
Automation and Integration
# List all available Trusted Advisor checks (requires Business/Enterprise support)
aws support describe-trusted-advisor-checks \
--language en \
--query 'checks[*].[id,name,category]' \
--output table
# Get specific check results - Idle Load Balancers
aws support describe-trusted-advisor-check-result \
--check-id "hjLMh88uM8" \
--query 'result.{Status:status,ResourcesSummary:resourcesSummary}'
# List all flagged resources for a check
aws support describe-trusted-advisor-check-result \
--check-id "hjLMh88uM8" \
--query 'result.flaggedResources[*]'# Refresh a specific Trusted Advisor check
# Note: Some checks have refresh cooldowns (e.g., 5 minutes)
aws support refresh-trusted-advisor-check \
--check-id "hjLMh88uM8"
# Monitor refresh status
aws support describe-trusted-advisor-check-refresh-statuses \
--check-ids "hjLMh88uM8"
# Common check IDs:
# hjLMh88uM8 - Idle Load Balancers
# Z4AUBRNSmz - Unassociated Elastic IP Addresses
# Qch7DwouX1 - Low Utilization Amazon EC2 Instances
# Ti39halfu8 - Idle RDS DB Instances# Create EventBridge rule for Trusted Advisor check status changes
aws events put-rule \
--name "TrustedAdvisorCostAlerts" \
--event-pattern '{
"source": ["aws.trustedadvisor"],
"detail-type": ["Trusted Advisor Check Item Refresh Notification"],
"detail": {
"status": ["WARN", "ERROR"],
"check-name": [
"Low Utilization Amazon EC2 Instances",
"Idle Load Balancers",
"Unassociated Elastic IP Addresses"
]
}
}' \
--state ENABLED
# Add SNS topic as target for notifications
aws events put-targets \
--rule "TrustedAdvisorCostAlerts" \
--targets "Id"="1","Arn"="arn:aws:sns:us-east-1:123456789012:CostAlerts"# Lambda function triggered by EventBridge for automatic EIP cleanup
import boto3
import json
def lambda_handler(event, context):
ec2 = boto3.client('ec2')
# Get all Elastic IPs
response = ec2.describe_addresses()
released_eips = []
for address in response['Addresses']:
# Check if EIP is not associated with any instance or ENI
if 'InstanceId' not in address and 'NetworkInterfaceId' not in address:
allocation_id = address.get('AllocationId')
public_ip = address.get('PublicIp')
# Release the unassociated EIP
try:
ec2.release_address(AllocationId=allocation_id)
released_eips.append(public_ip)
print(f"Released idle EIP: {public_ip}")
except Exception as e:
print(f"Error releasing {public_ip}: {str(e)}")
return {
'statusCode': 200,
'body': json.dumps({
'message': f'Released {len(released_eips)} idle EIPs',
'released': released_eips
})
}Decision Framework
When to Use Trusted Advisor vs Other Tools
| Use Case | Trusted Advisor | Cost Explorer | Compute Optimizer | AWS Config |
|---|---|---|---|---|
| Identify idle load balancers | Best choice | Can show cost, not utilization | Not applicable | Can detect but not analyze |
| Find underutilized EC2 | Good (CPU only) | Shows cost trends | Best (comprehensive) | Rule-based detection |
| Unassociated Elastic IPs | Best choice | Shows costs only | Not applicable | Can create rules |
| Right-sizing recommendations | Basic recommendations | Not applicable | Best (ML-based) | Not applicable |
| Security best practices | Core checks free | Not applicable | Not applicable | Comprehensive rules |
| Service limit monitoring | Real-time alerts | Not applicable | Not applicable | Limited |
| Historical cost analysis | Not applicable | Best choice | Not applicable | Not applicable |
| Compliance enforcement | Limited | Not applicable | Not applicable | Best choice |
Best Practices
-
Enable Business Support for Production Accounts: The cost optimization checks alone can pay for Business support many times over by identifying waste
-
Schedule Regular Reviews: Set up weekly or monthly reviews of Trusted Advisor findings with stakeholders
-
Automate Where Possible: Use EventBridge + Lambda for automatic remediation of low-risk items (idle EIPs)
-
Combine with Other Tools: Use Trusted Advisor with Cost Explorer, Compute Optimizer, and AWS Config for comprehensive optimization
-
Act on High-Impact Items First: Prioritize findings by estimated monthly savings
-
Document Exceptions: Some flagged resources may be intentionally idle; document these to avoid repeated reviews
-
Include in CI/CD: Check Trusted Advisor before deployments to catch issues early
-
Set Up Notifications: Configure EventBridge rules for immediate alerts on critical findings
Common Pitfalls
Assuming All Checks Are Available
The Mistake: Expecting full Trusted Advisor functionality with Basic or Developer support.
Reality: Basic and Developer tiers only include 6 core security checks. Cost optimization, performance, fault tolerance, and service limits checks require Business or Enterprise support.
Impact: Organizations miss critical cost optimization opportunities like idle load balancers, underutilized instances, and unassociated Elastic IPs.
The Fix: Upgrade to Business support for accounts with significant spend. The cost optimization findings typically justify the support cost.
Blindly Following Underutilized EC2 Recommendations
The Mistake: Automatically right-sizing or terminating instances flagged as underutilized without investigation.
Reality: Trusted Advisor checks CPU utilization over 14 days. It doesn't account for:
- Monthly batch jobs that spike briefly
- Memory-intensive workloads (CloudWatch agent needed)
- Planned capacity for growth
- Disaster recovery standby instances
The Fix: Validate findings with CloudWatch metrics, application logs, and team input before taking action. Consider extended monitoring periods.
Ignoring Trusted Advisor Refresh Limits
The Mistake: Expecting real-time data from Trusted Advisor checks.
Reality: Most checks have refresh cooldowns (typically 5 minutes to 24 hours). Data can be hours or days old.
Impact: Acting on stale data may lead to incorrect decisions. Resources may have been modified since last check.
The Fix: Manually refresh checks before making decisions. For real-time monitoring, use CloudWatch metrics and alarms instead.
Missing EventBridge Integration for Automation
The Mistake: Manually reviewing Trusted Advisor dashboard without automation.
Reality: Manual reviews are time-consuming and often delayed. Cost waste accumulates between reviews.
Impact: Idle resources continue incurring charges for weeks or months before discovery.
The Fix: Set up EventBridge rules to trigger notifications or Lambda functions when Trusted Advisor detects issues. Automate remediation for safe actions like releasing unassociated EIPs.
Not Correlating Findings with Business Context
The Mistake: Treating all Trusted Advisor warnings as problems requiring immediate action.
Reality: Some flagged resources are intentionally configured:
- Pre-provisioned capacity for expected traffic
- Disaster recovery instances kept idle
- Development resources with intentional over-provisioning
- Reserved capacity for contractual SLAs
The Fix: Create documentation for intentional exceptions. Tag resources appropriately. Review findings with application owners before taking action.
Exam Scenarios
Scenario-Based Questions
| Scenario | Best Solution | Key Reasoning |
|---|---|---|
| Company wants to identify EC2 instances running under 10% CPU utilization | AWS Trusted Advisor | Specifically checks for underutilized EC2 instances |
| Organization needs to find all idle load balancers across accounts | Trusted Advisor (with Business support) | Idle Load Balancer check identifies ELBs with no traffic |
| Architect needs to automate cleanup of unassociated Elastic IPs | Trusted Advisor + EventBridge + Lambda | EventBridge triggers Lambda to release flagged EIPs |
| Company on Basic support wants cost optimization recommendations | Upgrade to Business support OR use Cost Explorer | Cost optimization checks require Business tier |
| Need real-time alerts when approaching service limits | Trusted Advisor (Business/Enterprise) | Service Limits checks monitor usage vs quotas |
| Find RDS instances with no connections for extended periods | Trusted Advisor Idle RDS check | Identifies databases with 0 connections for 7+ days |
| Automated remediation of security findings | Trusted Advisor + Security Hub + Lambda | Security Hub can orchestrate remediation actions |
| Comprehensive right-sizing with memory analysis | AWS Compute Optimizer | Trusted Advisor only checks CPU; Compute Optimizer includes memory |
Exam Question Patterns
-
"Identify underutilized resources" = Trusted Advisor (Business/Enterprise support required)
-
"Find idle load balancers" = Trusted Advisor Idle Load Balancer check
-
"Unassociated Elastic IPs" = Trusted Advisor check (shows EIPs not attached to running instances)
-
"Basic support plan" + "cost optimization" = Not available; need Business tier
-
"Automate response to findings" = EventBridge + Lambda integration
-
"Service quota monitoring" = Trusted Advisor Service Limits checks
-
"Security best practices audit" = Trusted Advisor (6 core checks free, all checks with Business)
-
"Right-sizing with memory analysis" = AWS Compute Optimizer (not Trusted Advisor)
Test Your Knowledge
A company using AWS Basic Support wants to identify underutilized EC2 instances and idle load balancers. What should they do?
A Solutions Architect wants to automatically release unassociated Elastic IP addresses when detected by Trusted Advisor. What is the MOST operationally efficient solution?
Trusted Advisor shows an EC2 instance as underutilized with 5% average CPU over 14 days. The instance runs a memory-intensive Java application. What should the architect do FIRST?
A company wants to monitor when their AWS service usage approaches limits. They have AWS Business Support. What is the MOST efficient approach?
Related Services
Quick Reference
Trusted Advisor Check Categories
| Category | Free Tier | Business+ Tier | Primary Use |
|---|---|---|---|
| Cost Optimization | 0 checks | 10+ checks | Reduce spending |
| Performance | 0 checks | 10+ checks | Improve speed |
| Security | 6 checks | 40+ checks | Identify vulnerabilities |
| Fault Tolerance | 0 checks | 10+ checks | Improve availability |
| Service Limits | 0 checks | 50+ checks | Prevent quota issues |
Key Cost Optimization Checks
| Check Name | Check ID | What It Flags |
|---|---|---|
| Idle Load Balancers | hjLMh88uM8 | ELBs with no traffic or instances |
| Unassociated Elastic IPs | Z4AUBRNSmz | EIPs not attached to running instances |
| Low Utilization EC2 | Qch7DwouX1 | Instances < 10% CPU over 14 days |
| Idle RDS DB Instances | Ti39halfu8 | DBs with 0 connections for 7+ days |
| Underutilized EBS Volumes | DAvU99Dc4C | Low I/O volumes |
Cost Impact of Idle Resources
| Resource Type | Idle Cost/Month | Typical Waste |
|---|---|---|
| Unassociated EIP | $3.60 | Easy to accumulate |
| Idle Classic LB | $18 | Common after migrations |
| Idle ALB/NLB | $22.50+ | Forgotten dev resources |
| Idle db.t3.medium | $48 | Test databases |
| Idle m5.large EC2 | $70+ | Over-provisioned instances |
CLI Quick Reference
# List all Trusted Advisor checks (Business/Enterprise support)
aws support describe-trusted-advisor-checks --language en
# Get check results
aws support describe-trusted-advisor-check-result --check-id "CHECK_ID"
# Refresh a check
aws support refresh-trusted-advisor-check --check-id "CHECK_ID"
# Common Check IDs:
# hjLMh88uM8 - Idle Load Balancers
# Z4AUBRNSmz - Unassociated Elastic IP Addresses
# Qch7DwouX1 - Low Utilization EC2 Instances
# Ti39halfu8 - Idle RDS DB Instances
# DAvU99Dc4C - Underutilized EBS Volumes
# 1iG5NDGVre - S3 Bucket Permissions (FREE)
# HCP4007jGY - Security Groups - Unrestricted (FREE)
Support Tier Decision Guide
| Question | Answer |
|---|---|
| Need cost optimization checks? | Business support or higher |
| Only need security basics? | Basic/Developer (6 checks free) |
| Want automated remediation? | EventBridge + Lambda |
| Need service limit monitoring? | Business support or higher |
| Comprehensive right-sizing? | Use Compute Optimizer |
| Historical cost trends? | Use Cost Explorer |