AWS Trusted Advisor: The SAA-C03 Study Guide

AWS Trusted Advisor is an online tool that provides real-time guidance to help you provision your resources following AWS best practices. It acts as a customized cloud consultant that scans your AWS environment and compares it against the five pillars of optimization.

The Analogy: Think of Trusted Advisor as a “Vehicle Health Report” for your car. Just as a modern car’s computer monitors tire pressure, oil levels, and engine efficiency, Trusted Advisor monitors your AWS account for “low tire pressure” (security gaps), “wasted fuel” (unused resources), and “engine wear” (performance bottlenecks).

Core Concepts & The Well-Architected Framework

Trusted Advisor aligns directly with the AWS Well-Architected Framework by automating the inspection of your architecture. It focuses on five specific categories:

Cost Optimization: Identifies idle resources (e.g., unassociated Elastic IPs) and underutilized instances.
Performance: Checks service limits and monitors for over-utilized instances.
Security: Identifies security gaps like “Publicly Accessible S3 Buckets” or “Security Groups with unrestricted access (0.0.0.0/0)”.
Fault Tolerance: Suggests improvements for availability, such as enabling Multi-AZ on RDS or checking for missing EBS snapshots.
Service Limits: Monitors your usage against service quotas to prevent hitting limits during peak traffic.

Comparison: Trusted Advisor Support Tiers

Feature	Basic & Developer Support	Business & Enterprise Support
Access Level	Core Checks (7 checks)	Full Check Suite (All checks)
Security Checks	S3 Permissions, Security Groups	Comprehensive (IAM, MFA, CloudTrail, etc.)
Service Limits	Included (Limited)	Full Quota Monitoring
API Access	No	Yes (via AWS Support API)

Scenario-Based Learning (Decision Matrix)

If the requirement is… Use this Trusted Advisor feature:

“We need to reduce costs immediately.” → Check “Idle Load Balancers” and “Unassociated Elastic IP Addresses”.
“We are worried about data leaks.” → Check “Amazon S3 Bucket Permissions” (Security Pillar).
“We are planning a massive launch tomorrow.” → Check “Service Limits” to ensure you don’t hit EC2 or VPC quotas.
“We need to automate remediation.” → Integrate Trusted Advisor with Amazon EventBridge to trigger Lambda functions when a check fails.

Exam Tips: Golden Nuggets

The “Free” Myth: Remember that only 7 “Core” checks are free. For the full suite, you MUST have Business or Enterprise support.
S3 Public Access: This is a high-frequency exam topic. Trusted Advisor is the primary tool for identifying buckets with public read/write access.
Weekly Emails: You can configure Trusted Advisor to send weekly status emails to account contacts.
Automation: Trusted Advisor does NOT fix problems automatically. It only identifies them. You must use EventBridge + Lambda for “Auto-healing”.

Architectural Flow: Trusted Advisor Inspection

Key Services

Integrates with AWS Organizations for organizational-wide views and AWS Shield for security posture checks.

Common Pitfalls

Assuming Trusted Advisor can remediate issues. It is a reporting tool, not a management tool like AWS Config.

Quick Patterns

Use Trusted Advisor + EventBridge + Lambda to automatically shut down idle EC2 instances identified in cost checks.