Description

Ensure that AWS Trusted Advisor checks are reviewed and that no check remains in the warning (yellow) or error (red) state. Trusted Advisor inspects the account across categories such as security, fault tolerance, service limits, performance and cost optimization, and flags configurations or quotas that need attention.

Rationale

Unaddressed Trusted Advisor warnings and errors can leave misconfigurations in place, such as public access to data, weak authentication, overly permissive settings, service quotas close to exhaustion or resources without resilience. These can lead to data exposure, unwanted changes, outages and unnecessary cost. A continuous process that prioritizes errors and then warnings, assigns owners and deadlines, and reassesses regularly ensures that the findings are fixed and do not return.

Impact

  • Provides a continuous review of security, resilience, quota and cost findings

  • Reduces the risk of data exposure, outages and unnecessary spending

  • Fixing individual findings may change resources or configurations, and each change must be planned with its owner

Default Value

Trusted Advisor is available in every AWS account. Accounts with Basic or Developer support have access to a limited set of core checks only. The full set of checks, and access to Trusted Advisor through the AWS Support API, require a Business, Enterprise On-Ramp or Enterprise support plan.

Pre-Requisites

  • A Business, Enterprise On-Ramp or Enterprise support plan. Without one of these plans, the check results cannot be read through the AWS Support API, and this control must be reviewed manually in the Trusted Advisor console

  • IAM permissions: support:DescribeTrustedAdvisorChecks, support:DescribeTrustedAdvisorCheckSummaries, support:DescribeTrustedAdvisorCheckResult and support:RefreshTrustedAdvisorCheck

  • Owners for each affected area (security, networking, cost) who can approve the changes recommended by Trusted Advisor

Remediation

Test Plan

This control produces a pass or fail result only when the account has a Business, Enterprise On-Ramp or Enterprise support plan. With a Basic or Developer support plan, the result is manual: review the core checks in the Trusted Advisor console.

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Trusted Advisor console.

  3. Review the checks in each category.

  4. Check for any check with the status Action recommended (red) or Investigation recommended (yellow).

  5. If any check is in one of these states, follow the implementation steps.

CLI:

List all Trusted Advisor checks with their IDs:

aws support describe-trusted-advisor-checks --language en --query "checks[].[id,name,category]" --output table

Show the status of one or more checks:

aws support describe-trusted-advisor-check-summaries --check-ids <CHECK_ID> --query "summaries[].[checkId,status]" --output table

A check fails if its status is warning or error. Checks with the status not_available (no resources to evaluate) are skipped, and checks with the status ok pass. If the commands return a SubscriptionRequiredException error, the account does not have a qualifying support plan and the control must be reviewed manually.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Trusted Advisor console.

  3. Filter the checks to show those with the status Action recommended or Investigation recommended, starting with Action recommended.

  4. Open each check and review the flagged resources and the recommended action.

  5. Apply the recommended fix to each flagged resource, after agreeing the change with its owner.

  6. Refresh the check and confirm that its status changes to No problems detected.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Identify the resource changed while fixing a Trusted Advisor finding.

  3. Revert the change using the backout steps of the related remediation, or restore the previous configuration of the resource.

  4. Refresh the related Trusted Advisor check.

Note: rolling back a fix brings the related Trusted Advisor warning or error back, together with its risk.

Reference