5.1.5. Trusted Advisor Security Checks and Remediation
💡 First Principle: Security misconfigurations don't announce themselves — they accumulate silently until someone exploits them. Trusted Advisor is AWS's automated best-practice auditor: it continuously checks your account against hundreds of recommendations and surfaces the ones that require attention before they become incidents.
Trusted Advisor Check Categories:
| Category | Examples |
|---|---|
| Cost Optimization | Underutilized EC2 instances, idle load balancers |
| Performance | High-utilization instances, CloudFront config |
| Security | Open security groups, MFA on root, exposed IAM access keys |
| Fault Tolerance | RDS Multi-AZ, Auto Scaling, EBS snapshots |
| Service Limits | Approaching EC2, VPC, or IAM limits |
| Operational Excellence | CloudTrail enabled, service limits |
Checks Available on All Support Plans (Basic included): every check in the Service Limits category, plus a small set of core security checks (on Basic you refresh these manually):
- S3 bucket permissions (public read/write)
- Security groups with unrestricted access (0.0.0.0/0) on specific high-risk ports (port 22, port 3389)
- MFA on root account
- EBS public snapshots and RDS public snapshots
- IAM use
Full Check Set (Business Support+, Enterprise or Unified Operations): every other check in every category, plus the Trusted Advisor API and EventBridge check-status events. Examples:
- Exposed access keys (keys found in public code repositories)
- CloudTrail logging and IAM password policy
- Cost and performance checks such as low-utilization and high-utilization EC2 instances
Trusted Advisor Notifications: Configure email notifications for check status changes. Integrate with EventBridge to trigger automated remediation when a check status changes to "Warning" or "Error."
Trusted Advisor API: Programmatically refresh checks and retrieve results. Use with Lambda and EventBridge for automated remediation workflows:
Trusted Advisor check → "Error" status → EventBridge rule → Lambda → remediate
Closing public S3 access: S3 Block Public Access (bucket or account level) makes S3 ignore public ACLs, restrict access granted by public bucket policies, and reject new public grants. The bucket stays private on its own only once the public policy statements and ACL grants are also removed. Server-side encryption changes how objects are stored, not who may request them.
Trusted Advisor vs. Security Hub: Trusted Advisor runs AWS best-practice checks across cost, performance, security, fault tolerance, service limits and operational excellence. Security Hub (5.2.4) is security-only: it aggregates findings from GuardDuty, Inspector, Macie, Config and partner tools and runs compliance standards such as CIS across accounts. Neither detects active threats itself; that is GuardDuty.
⚠️ Exam Trap: Trusted Advisor does not automatically fix anything — it identifies issues and reports them. Remediation is always a separate action (manual or automated via Lambda/SSM). Also, the full set of Trusted Advisor checks requires Business or Enterprise support — not Developer or Basic. Questions about "automatically detecting exposed IAM keys" point to Trusted Advisor (with Business support) or IAM Access Analyzer.
Reflection Question: A security operations team wants to receive an automated alert and trigger remediation whenever Trusted Advisor detects a security group with port 22 open to the internet. What event-driven architecture do you build using Trusted Advisor, EventBridge, and Lambda?
