# Ensure there are no Trusted Advisor checks in error or warning state - Source: https://support.icompaas.com/support/solutions/articles/a_1793292226727270-ensure-there-are-no-trusted-advisor-checks-in-error-or-warning-state - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that AWS Trusted Advisor checks are reviewed and that no check remains in the warning (yellow) or error (red) state. Trusted Advisor inspects the account across categories such as security, fault tolerance, service limits, performance and cost optimization, and flags configurations or quotas that need attention. **Rationale** Unaddressed Trusted Advisor warnings and errors can leave misconfigurations in place, such as public access to data, weak authentication, overly permissive settings, service quotas close to exhaustion or resources without resilience. These can lead to data exposure, unwanted changes, outages and unnecessary cost. A continuous process that prioritizes errors and then warnings, assigns owners and deadlines, and reassesses regularly ensures that the findings are fixed and do not return. **Impact** - Provides a continuous review of security, resilience, quota and cost findings - Reduces the risk of data exposure, outages and unnecessary spending - Fixing individual findings may change resources or configurations, and each change must be planned with its owner **Default Value** Trusted Advisor is available in every AWS account. Accounts with Basic or Developer support have access to a limited set of core checks only. The full set of checks, and access to Trusted Advisor through the AWS Support API, require a Business, Enterprise On-Ramp or Enterprise support plan. **Pre-Requisites** - A Business, Enterprise On-Ramp or Enterprise support plan. Without one of these plans, the check results cannot be read through the AWS Support API, and this control must be reviewed manually in the Trusted Advisor console - IAM permissions: support:DescribeTrustedAdvisorChecks, support:DescribeTrustedAdvisorCheckSummaries, support:DescribeTrustedAdvisorCheckResult and support:RefreshTrustedAdvisorCheck - Owners for each affected area (security, networking, cost) who can approve the changes recommended by Trusted Advisor **Remediation** **Test Plan** This control produces a pass or fail result only when the account has a Business, Enterprise On-Ramp or Enterprise support plan. With a Basic or Developer support plan, the result is manual: review the core checks in the Trusted Advisor console. **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Trusted Advisor console. 3. Review the checks in each category. 4. Check for any check with the status **Action recommended** (red) or **Investigation recommended** (yellow). 5. If any check is in one of these states, follow the implementation steps. **CLI:** List all Trusted Advisor checks with their IDs: aws support describe-trusted-advisor-checks --language en --query "checks\[\].\[id,name,category\]" --output table Show the status of one or more checks: aws support describe-trusted-advisor-check-summaries --check-ids --query "summaries\[\].\[checkId,status\]" --output table A check fails if its status is warning or error. Checks with the status not\_available (no resources to evaluate) are skipped, and checks with the status ok pass. If the commands return a SubscriptionRequiredException error, the account does not have a qualifying support plan and the control must be reviewed manually. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Trusted Advisor console. 3. Filter the checks to show those with the status **Action recommended** or **Investigation recommended**, starting with **Action recommended**. 4. Open each check and review the flagged resources and the recommended action. 5. Apply the recommended fix to each flagged resource, after agreeing the change with its owner. 6. Refresh the check and confirm that its status changes to **No problems detected**. **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Identify the resource changed while fixing a Trusted Advisor finding. 3. Revert the change using the backout steps of the related remediation, or restore the previous configuration of the resource. 4. Refresh the related Trusted Advisor check. Note: rolling back a fix brings the related Trusted Advisor warning or error back, together with its risk. **Reference** - [https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor.html](https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor.html) - [https://aws.amazon.com/premiumsupport/technology/trusted-advisor/best-practice-checklist/](https://aws.amazon.com/premiumsupport/technology/trusted-advisor/best-practice-checklist/) - [https://docs.aws.amazon.com/cli/latest/reference/support/describe-trusted-advisor-check-summaries.html](https://docs.aws.amazon.com/cli/latest/reference/support/describe-trusted-advisor-check-summaries.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.