Do all Trusted Advisor checks require a paid Support plan?

No, but most do, a small set of core checks (some security and service limit checks) are available on Basic/Developer support, while the full catalog, including most cost-optimization checks like the ones in this example, requires Business or Enterprise Support. If your account is on Basic support, a configuration listing checks outside that limited free set won't return meaningful results even though the configuration itself is syntactically valid.

Does ExcludedResources permanently suppress a finding, or does it need periodic review?

It suppresses the specific listed resource ID from that check's findings indefinitely, until the exclusion entry is removed, it's not time-bounded. This means an exclusion added for a temporary reason (a short-term test instance) can persist long after the original justification is gone, periodic review of the ExcludedResources list (similar to reviewing any other suppression list) is a good practice to avoid permanently blind-spotting a resource.

What does RefreshInterval on an individual check actually control?

How frequently Trusted Advisor re-evaluates that specific check against your account's current resource state, most checks refresh on a schedule Trusted Advisor manages, but for checks that support explicit refresh configuration, tuning RefreshInterval affects how quickly a resolved issue disappears from findings or a new issue is detected, a longer interval means findings can lag real-world changes to your infrastructure.

AWS Trusted Advisor Check Builder

MonitoringAWS

Build Trusted Advisor check configurations for cost optimization, security, and performance with notification preferences.

AWS Trusted Advisor Configuration

Build Trusted Advisor check configurations for cost optimization, security, and performance with notification preferences.

Required Fields

CheckNameCategoryChecks

{
  "CheckName": "custom-cost-optimization-review",
  "Description": "Custom Trusted Advisor check configuration for cost optimization and security review",
  "Category": "cost_optimizing",
  "OrganizationalUnitScope": {
    "OrganizationalUnitIds": [
      "ou-abc1-23456789"
    ],
    "AllAccounts": false
  },
  "NotificationPreferences": {
    "Language": "en",
    "ContactMethod": ["email", "slack"],
    "EmailAddresses": [
      "cloud-ops@example.com",
      "finops@example.com"
    ],
    "SlackChannelConfiguration": {
      "ChannelId": "C0ABC123DEF",
      "TeamId": "T0ABC123DEF"
    }
  },
  "Checks": [
    {
      "Id": "Qch7DwouX1",
      "Name": "Low Utilization Amazon EC2 Instances",
      "Category": "cost_optimizing",
      "RefreshInterval": "24h"
    },
    {
      "Id": "DAvU99Dc4C",
      "Name": "Underutilized Amazon EBS Volumes",
      "Category": "cost_optimizing",
      "RefreshInterval": "24h"
    },
    {
      "Id": "hjLMh88uM8",
      "Name": "Idle Load Balancers",
      "Category": "cost_optimizing",
      "RefreshInterval": "24h"
    },
    {
      "Id": "HCP4007jGY",
      "Name": "Security Groups - Specific Ports Unrestricted",
      "Category": "security",
      "RefreshInterval": "24h"
    },
    {
      "Id": "1iG5NDGVre",
      "Name": "S3 Bucket Permissions",
      "Category": "security",
      "RefreshInterval": "24h"
    }
  ],
  "ExcludedResources": [
    {
      "ResourceId": "i-0abc123development",
      "Reason": "Development instance - expected low utilization"
    }
  ]
}

Generated Output

Output will appear here...

What This Tool Does

Build a Trusted Advisor check monitoring configuration listing specific checks by their documented Check IDs (each check has a stable ID like Qch7DwouX1 for 'Low Utilization Amazon EC2 Instances'), grouped by category (cost_optimizing, security, performance), with OrganizationalUnitScope limiting which accounts in an AWS Organization the configuration applies to, and ExcludedResources carving out specific known-exception resources (like a deliberately low-utilization dev instance) from triggering findings. Most Trusted Advisor checks, including cost-optimization ones, require a Business or Enterprise Support plan to access programmatically or see full results, Basic/Developer support tiers only get a handful of core checks, so a configuration referencing the full check catalog silently returns incomplete results on a lower support tier.

Technical Details

The builder validates that CheckName, Category, and Checks all resolve before accepting the JSON as a plausible Trusted Advisor monitoring configuration; it can't verify the specific Check ID values are current and valid (Trusted Advisor's check catalog and IDs can change) or that your account's support plan actually grants access to the referenced checks, those are only confirmed against the live Trusted Advisor API.

Common Use Cases

1Scoping OrganizationalUnitScope to a specific OU rather than AllAccounts, so a cost-optimization review targets only production-tier accounts and doesn't mix in sandbox/dev account noise where low utilization is often expected and not actionable.
2Adding an ExcludedResources entry with a documented Reason for a specific instance ID known to be intentionally low-utilization (a dev/test instance), so it doesn't repeatedly surface as a false-positive cost-optimization finding that gets ignored anyway.
3Setting NotificationPreferences to route findings to both email and a Slack channel via SlackChannelConfiguration, so cost/security findings reach the team's actual working channel rather than only appearing when someone manually checks the Trusted Advisor console.
4Bundling both cost_optimizing and security category checks (idle load balancers alongside unrestricted security groups) into one review configuration when a quarterly infrastructure health review covers both cost and security posture together.

Common Questions

Do all Trusted Advisor checks require a paid Support plan?: No, but most do, a small set of core checks (some security and service limit checks) are available on Basic/Developer support, while the full catalog, including most cost-optimization checks like the ones in this example, requires Business or Enterprise Support. If your account is on Basic support, a configuration listing checks outside that limited free set won't return meaningful results even though the configuration itself is syntactically valid.
Does ExcludedResources permanently suppress a finding, or does it need periodic review?: It suppresses the specific listed resource ID from that check's findings indefinitely, until the exclusion entry is removed, it's not time-bounded. This means an exclusion added for a temporary reason (a short-term test instance) can persist long after the original justification is gone, periodic review of the ExcludedResources list (similar to reviewing any other suppression list) is a good practice to avoid permanently blind-spotting a resource.
What does RefreshInterval on an individual check actually control?: How frequently Trusted Advisor re-evaluates that specific check against your account's current resource state, most checks refresh on a schedule Trusted Advisor manages, but for checks that support explicit refresh configuration, tuning RefreshInterval affects how quickly a resolved issue disappears from findings or a new issue is detected, a longer interval means findings can lag real-world changes to your infrastructure.

Expert Tips

TIP

Verify your account's actual AWS Support plan tier before building out a check configuration referencing the full cost-optimization/security/performance catalog, most of these checks are gated behind Business or Enterprise Support and return nothing meaningful on Basic/Developer tiers.

TIP

Review the ExcludedResources list periodically, an exclusion added for a legitimate temporary reason has no expiration and can quietly suppress a real, newly-relevant finding on that same resource ID indefinitely.

TIP

Scope OrganizationalUnitScope deliberately rather than defaulting to AllAccounts, mixing sandbox/dev accounts (where low utilization is often intentional) into a production cost-optimization review dilutes the signal with expected, non-actionable findings.

Related Learning Guides

DynamoDB Data Modeling28 min read
Cost Optimization Strategies26 min read

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.

AWS Trusted Advisor Check Builder

MonitoringAWS

Build Trusted Advisor check configurations for cost optimization, security, and performance with notification preferences.

AWS Trusted Advisor Configuration

Build Trusted Advisor check configurations for cost optimization, security, and performance with notification preferences.

Required Fields

CheckNameCategoryChecks

Generated Output

Output will appear here...

What This Tool Does

Technical Details

Common Use Cases

1Scoping OrganizationalUnitScope to a specific OU rather than AllAccounts, so a cost-optimization review targets only production-tier accounts and doesn't mix in sandbox/dev account noise where low utilization is often expected and not actionable.
2Adding an ExcludedResources entry with a documented Reason for a specific instance ID known to be intentionally low-utilization (a dev/test instance), so it doesn't repeatedly surface as a false-positive cost-optimization finding that gets ignored anyway.
3Setting NotificationPreferences to route findings to both email and a Slack channel via SlackChannelConfiguration, so cost/security findings reach the team's actual working channel rather than only appearing when someone manually checks the Trusted Advisor console.
4Bundling both cost_optimizing and security category checks (idle load balancers alongside unrestricted security groups) into one review configuration when a quarterly infrastructure health review covers both cost and security posture together.

Common Questions

Do all Trusted Advisor checks require a paid Support plan?: No, but most do, a small set of core checks (some security and service limit checks) are available on Basic/Developer support, while the full catalog, including most cost-optimization checks like the ones in this example, requires Business or Enterprise Support. If your account is on Basic support, a configuration listing checks outside that limited free set won't return meaningful results even though the configuration itself is syntactically valid.
Does ExcludedResources permanently suppress a finding, or does it need periodic review?: It suppresses the specific listed resource ID from that check's findings indefinitely, until the exclusion entry is removed, it's not time-bounded. This means an exclusion added for a temporary reason (a short-term test instance) can persist long after the original justification is gone, periodic review of the ExcludedResources list (similar to reviewing any other suppression list) is a good practice to avoid permanently blind-spotting a resource.
What does RefreshInterval on an individual check actually control?: How frequently Trusted Advisor re-evaluates that specific check against your account's current resource state, most checks refresh on a schedule Trusted Advisor manages, but for checks that support explicit refresh configuration, tuning RefreshInterval affects how quickly a resolved issue disappears from findings or a new issue is detected, a longer interval means findings can lag real-world changes to your infrastructure.

Expert Tips

TIP

Related Learning Guides

DynamoDB Data Modeling28 min read
Cost Optimization Strategies26 min read

Was this tool helpful?