- Now, let's review optimizing usage with
AWS Trusted Advisor.
So, AWS Trusted Advisor is an
automated tool that regularly
automatically analyzes your environment and
compares what you're doing and the state of
your infrastructure to best practices.
And, then it can advise you based on
those best practice recommendations.
It can advise you to ways that
we can improve cost optimization.
It will recommend ways to save money,
recommend ways to improve performance.
It can recommend ways to improve security,
and also recommend ways to improve fault tolerance.
So, for example, it might look to see that
you have certain Security Group Ports that
are open that are known to be insecure,
and it might recommend that you close those ports.
It might see that you've been running a
particular EC2 Instance using the
On-Demand Billing Model for an extended period of time.
And, it might recommend that you could save money by
switching to or purchasing a Reserved Instance.
It might see that you are running,
let's say, one EC2 Instance behind a Load Balancer,
in which case you don't have any fault tolerance.
It might notice that you're running a RDS Instance in
a Single AZ rather than Multi-AZ Deployment.
Which, could improve fault tolerance.
And, so everyone, no matter what
level of support you are paying for,
everyone gains access to seven core checks.
And, those core checks, are one
looking at your S3 Bucket Permissions.
This is an area, in particular, where over the years,
a number of organizations have gotten themselves in
trouble by making sensitive information
available to the public.
And, I think, in those cases, it's just a matter of
a combination of a lack of education
and a lack of communication.
And, so, one of the things that
the Trusted Advisor can do is take a look at
your S3 Bucket Permissions and inform you that
certain buckets may be making
certain data publicly available.
Another thing that the Trusted Advisor will do is,
like I mentioned earlier, looking at
your security groups and taking note of
certain ports that are left unrestricted.
For example, it would probably be a security issue if
you were opening Port 22 to everywhere, right?
Ideally, to have more security around that,
you would probably want to open Port 22 from a
small, trusted range of IP Addresses,
like a VPN connection, for example.
Another one of the checks would be your use of IAM.
It can look through the policies that you are
giving to your users, to your groups and roles,
and tell you that, perhaps, you are
giving more permissions than are necessary for
that particular use case.
It will also look to see if you have enabled
Multi-Factor Authentication on the Root Account.
Remember that if you are logging into the console
with an email address, then you are logging into
the Root Account, and that Root Account,
we call it the Root Account because it has
essentially root permissions,
or administrative permissions,
and you cannot limit those.
So, if someone were to gain access to
those Root Credentials,
they could really do some damage.
In fact, companies have gone out of business.
So, it's really important that
we take every measure we can to
protect those Root Account Credentials,
including configuring MFA for the Root Account.
And, again, one of those checks of
the Trusted Advisor is to inform you as
to whether or not you have done that.
Trusted Advisor can also look at your EBS Volumes,
and look at the Snapshots that you've created and
inform you whether or not
you have made any of those publicly available.
Right, so very similar to S3,
it could be, it's relatively trivial to
make EBS Snapshots publicly available to anyone.
And, so, that is something that we certainly
would not want to do if that Snapshot contained any
kind of sensitive data.
And, the same thing applies to RDS Snapshots.
We could make RDS Snapshots publicly available,
but only if they didn't include sensitive data.
So, that's one of the seven core checks.
It will also take a look at service limits.
So, remember, we've mentioned this a
number of times before throughout the course that
AWS does impose service limits,
there are hard limits and soft limits.
For example, one of those soft limits,
the initial default limit for EC2 Instances is 20 Instances.
Now, in order to go above that,
you would have to submit a ticket to
Amazon Support asking for an increase in that.
And, there are a number of soft limits like that
that can be increased.
And, so, one of the things that
Trusted Advisor will do here is
look through your account and inform you that
you are getting close to that limit.
If you have, let's say, a limit of 20 EC2 Instances,
and now you are at, let's say, 15, 16 Instances or so,
then the Trusted Advisor can warn you that
you are approaching that limit,
so you can increase that limit before you have the need.
Which, and I've been there before.
It's not a fun position to be in when
you need more than what you're allowed to create,
but you're stuck waiting on
Amazon to answer your Support Ticket.
So, those are the kinds of things that
you want to get out ahead of.
Now, all of these seven core checks are
available to everyone.
If you are paying for Business-level or
Enterprise-level Support, then you gain the
full benefits of Trusted Advisor.
Which, includes more than 40 different checks
across many different resources and many different types of
things going on in your Amazon Environment,
again all of it categorized according to
cost savings, security performance, and fault tolerance.
So, then, you also get the ability to receive notifications.
As the Trusted Advisor finds things, it can notify you.
And you gain Programmatic Access to the Trusted Advisor.
These two things, the full set of 40+ checks and
notifications and Programmatic Access are only
available to those of us who are paying for
Business-level or Enterprise-level Support.
If you have Basic Support, which is included,
or you're paying for Developer Support,
then you only gain access to those Seven Core Checks.
So, the Trusted Advisor, again, is an automated tool that
regularly scans your environment and recommend things that
you can do to improve that environment.
It's a good idea when you're using AWS to
regularly check with the Trusted Advisor,
every so often, every day, or every other day at least.
Go to the Trusted Advisor and see what it has to say.
If you see something new, listen to it.
Take its word, and go and explore ways to
mitigate that issue that it is showing you.