AWS provides an oft overlooked tool available to accounts with “Business” or “Enterprise” level support called Trusted Advisor (TA). Trusted Advisor is a tool that analyzes your current AWS resources for ways to improve your environment in the following categories:
- Cost Optimization
- Fault Tolerance
It rigorously scours your AWS resources for inefficiencies, waste, potential capacity issues, best practices, security holes and much, much more. It provides a very straightforward and easy to use interface for viewing the identified issues.
Trusted Advisor will do everything from detecting EC2 instances that are under-utilized (e.g. using an m3.xlarge for a low traffic NAT instance), to detecting S3 buckets that are good candidates for fronting with a CloudFront distribution, to identifying Security Groups with wide open access to a port(s), and everything in between.
In Amazon’s own words…
AWS Trusted Advisor inspects your AWS environment and makes recommendations for saving money, improving system performance and reliability, or closing security gaps. Since 2013, customers have viewed over 1.7 million best-practice recommendations in AWS Trusted Advisor in the categories of cost optimization, performance improvement, security, and fault tolerance, and they have realized over $300 million in estimated cost reductions. Currently, Trusted Advisor provides 37 checks; the most popular ones are Low Utilization Amazon.
Two new features of the TA console I found particularly noteworthy and useful are the Action Links and Access Management.
Action Links allow you to click a hyperlink next to an issue in the TA Console that redirects you to the appropriate place to take action on the issue. Pretty slick… saves you time jumping around tabs in your browser or navigate to the correct Console and menus. Action Links will also take the guess work out of hunting down the correct place if you aren’t that familiar with the AWS Console.
Access Management allows you to use AWS IAM (Identity and Access Management) credentials to control access to specific categories and checks within Trusted Advisor. This gives you the ability to have granular access control over which people in your organization can view and act on specific checks.
In addition to the console, Trusted Advisor also supports API access. And this wouldn’t be my AWS blog post without some kind of coding example using Python and the boto library. The following example code will print out a nicely formatted list of all the Trusted Advisory categories and each of the checks underneath them in alphabetical order.
#!/usr/bin/python from boto import connect_support conn = connect_support() ta_checks = sorted(conn.describe_trusted_advisor_checks('en')['checks'], key=lambda check: check['category']) for cat in sorted(set([ x['category'] for x in ta_checks ])): print "\n%s\n%s" % (cat, '-' * len(cat)) for check in sorted(ta_checks, key=lambda check: check['name']): if check['category'] == cat: print " %s" % check['name']
Here is the resulting output (notice all 37 checks are accounted for):
cost_optimizing --------------- Amazon EC2 Reserved Instances Optimization Amazon RDS Idle DB Instances Amazon Route 53 Latency Resource Record Sets Idle Load Balancers Low Utilization Amazon EC2 Instances Unassociated Elastic IP Addresses Underutilized Amazon EBS Volumes fault_tolerance --------------- Amazon EBS Snapshots Amazon EC2 Availability Zone Balance Amazon RDS Backups Amazon RDS Multi-AZ Amazon Route 53 Deleted Health Checks Amazon Route 53 Failover Resource Record Sets Amazon Route 53 High TTL Resource Record Sets Amazon Route 53 Name Server Delegations Amazon S3 Bucket Logging Auto Scaling Group Health Check Auto Scaling Group Resources Load Balancer Optimization VPN Tunnel Redundancy performance ----------- Amazon EBS Provisioned IOPS (SSD) Volume Attachment Configuration Amazon Route 53 Alias Resource Record Sets CloudFront Content Delivery Optimization High Utilization Amazon EC2 Instances Large Number of EC2 Security Group Rules Applied to an Instance Large Number of Rules in an EC2 Security Group Overutilized Amazon EBS Magnetic Volumes Service Limits security -------- AWS CloudTrail Logging Amazon RDS Security Group Access Risk Amazon Route 53 MX and SPF Resource Record Sets Amazon S3 Bucket Permissions IAM Password Policy IAM Use MFA on Root Account Security Groups - Specific Ports Unrestricted Security Groups - Unrestricted Access
In addition to the meta-data about categories and checks, actual TA check results and recommendations can also be pulled and refreshed using the API.
While Trusted Advisor is a great tool to quickly scan your AWS environment for inefficiencies, waste, potential cost savings, basic security issues, and best practices, it isn’t a “silver bullet” solution. It takes a specific set of AWS architectural understanding, skills, and experience to look at an entire application stack or ecosystem and ensure it is properly designed, built, and/or tuned to best utilize AWS and its array of complex and powerful building blocks. This where a company like 2nd Watch can add immense value in a providing a true “top down” cloud optimization. Our architects and engineers are the best in the business at ensuring applications and infrastructure are designed and implemented using AWS and cloud computing best practices with a fierce attention to detail and focus on our customers’ success in their business and cloud initiatives.
-Ryan Kennedy, Senior Cloud Architect