Trusted Advisor Security Checks

AWS Trusted Advisor inspects your account against AWS best practices and gives prioritized recommendations.

It spans five categories: cost optimization, performance, security, fault tolerance, and service limits. For the exam, the security checks are the focus.

Trusted Advisor's security checks surface common risky settings, such as:

• S3 buckets with open permissions.
• Security groups with unrestricted ports (like 0.0.0.0/0 on SSH).
• IAM use and whether MFA on the root account is enabled.

The depth of Trusted Advisor depends on your support plan.

• Basic and Developer plans get a core set of checks.
• Business and Enterprise plans unlock the full check set across all categories.

More security checks become available at the higher support tiers.

Each check shows a status: green (no problem), yellow (investigate), or red (action recommended).

Drilling in reveals the affected resources and the suggested fix. This makes Trusted Advisor a quick health scan rather than a deep investigation tool.

Checks refresh on a schedule, and you can refresh manually after making changes.

Trusted Advisor can send weekly email summaries and integrate with EventBridge, so a status change can trigger an automated alert or workflow.

A high-value security check confirms whether MFA is enabled on the root user.

The root account can do anything and should be locked down with MFA and rarely used. Trusted Advisor flags a missing root MFA as a red, must-fix finding.

While not strictly security, the service limits checks matter for resilience.

Hitting a limit during an incident, such as not being able to launch replacement instances, can prolong an outage. Trusted Advisor warns when you approach quotas so you can request increases early.

Both highlight misconfigurations, but they differ:

• Trusted Advisor gives broad, account-level best-practice checks across five categories.
• Security Hub runs deep security standards and aggregates findings from many security services.

Security Hub is the deeper, security-focused tool.

With the right support plan, Trusted Advisor offers an organizational view, rolling up checks across all accounts.

A central team can see, in one place, which accounts have open security groups or missing root MFA, supporting governance at scale.

Trusted Advisor includes a check that scans public code repositories for exposed IAM access keys tied to your account.

If a developer accidentally commits a key to a public repo, this check can flag it so you revoke and rotate it before an attacker abuses it. It is a valuable early-warning signal against a very common breach cause.

Use Trusted Advisor for a fast best-practice health check, especially for classic misconfigurations like open S3 buckets, wide-open security groups, and missing root MFA.

It is the go-to answer when a scenario wants a quick AWS-curated recommendation list rather than deep analysis.

Pick the tool for the job.

You learned how Trusted Advisor checks best practices.

• Its security category flags open buckets, wide security groups, and missing root MFA.
• Depth depends on the support plan; higher tiers unlock all checks.
• It offers an organizational view and EventBridge alerts.