AWS Trusted Advisor and Compute Optimizer: Cost and Performance Optimization

A startup burned $40k/month on a fleet of m5.xlarge instances that never exceeded 10% CPU. Their CTO thought they were being 'safe.' AWS Trusted Advisor flagged it in the first week, but nobody read the report. That's the problem: these tools are powerful but ignored. Trusted Advisor and Compute Optimizer aren't just dashboards—they're your first line of defense against cost bloat and performance rot. Trusted Advisor checks your account against AWS best practices (cost, security, performance, fault tolerance, service limits). Compute Optimizer goes deeper: it analyzes historical utilization and recommends instance types, sizes, and even auto-scaling configurations. Together, they form a feedback loop: Trusted Advisor catches the obvious waste, Compute Optimizer fine-tunes the rest. But they're not magic—you need to act on their recommendations, and that means understanding the trade-offs. In this article, I'll show you how to integrate both into your CI/CD pipeline, automate remediation, and avoid the pitfalls that make these tools just another ignored report.

Why Trusted Advisor and Compute Optimizer Matter

AWS Trusted Advisor and Compute Optimizer are two services that directly impact your cloud bill and application performance. Trusted Advisor checks your account against AWS best practices across cost, performance, security, and fault tolerance. Compute Optimizer uses machine learning to analyze your resource utilization and recommend right-sizing or instance type changes. Together, they form a feedback loop: Trusted Advisor flags idle or oversized resources, and Compute Optimizer provides granular recommendations for compute instances. Ignoring these tools means you're likely overprovisioning by 20-40% on average, based on AWS's own data. In production, we've seen teams save $50k/month just by acting on Trusted Advisor's idle load balancer and unassociated Elastic IP checks. The key is to treat these recommendations as actionable alerts, not just dashboard decorations.

#!/bin/bash
# Get Trusted Advisor cost-optimization checks via AWS CLI
aws support describe-trusted-advisor-checks --language en --query "checks[?category=='cost_optimizing']"
# Refresh and get result for a specific check (e.g., idle RDS instances)
aws support refresh-trusted-advisor-check --check-id zXC0k0lM9n
aws support describe-trusted-advisor-check-result --check-id zXC0k0lM9n --query "result.resourcesSummary"

Setting Up Trusted Advisor for Cost Alerts

Trusted Advisor offers a set of checks, but only Business and Enterprise support plans get full access to all checks, including cost optimization. For cost alerts, focus on: Idle Load Balancers, Underutilized Amazon EBS Volumes, Unassociated Elastic IP Addresses, and Reserved Instance (RI) lease expiration. To set up automated alerts, create an AWS Lambda function that calls the Trusted Advisor API, parses the results, and sends notifications via SNS. This avoids the manual console check. In production, we combine this with a weekly Slack notification that lists flagged resources and estimated savings. The Lambda function should handle pagination and rate limiting. Use the AWS SDK for Python (boto3) to refresh checks and retrieve results. Ensure the Lambda role has support:DescribeTrustedAdvisorCheck* and support:RefreshTrustedAdvisorCheck permissions.

import boto3
import json

def lambda_handler(event, context):
    client = boto3.client('support', region_name='us-east-1')
    # Refresh cost-optimizing checks
    checks = client.describe_trusted_advisor_checks(language='en')['checks']
    cost_checks = [c for c in checks if c['category'] == 'cost_optimizing']
    for check in cost_checks:
        client.refresh_trusted_advisor_check(check_id=check['id'])
    # Retrieve results
    results = []
    for check in cost_checks:
        result = client.describe_trusted_advisor_check_result(check_id=check['id'])
        flagged = result['result']['resourcesSummary']['resourcesFlagged']
        if flagged > 0:
            results.append({'check': check['name'], 'flagged': flagged})
    # Send SNS notification
    sns = boto3.client('sns')
    sns.publish(
        TopicArn='arn:aws:sns:us-east-1:123456789012:TrustedAdvisorAlerts',
        Message=json.dumps({'default': json.dumps(results)}),
        MessageStructure='json'
    )
    return {'statusCode': 200, 'body': json.dumps(results)}

Compute Optimizer: Right-Sizing EC2 Instances

AWS Compute Optimizer analyzes your EC2 instance utilization over the past 14 days (or longer with enhanced infrastructure metrics) and provides recommendations: over-provisioned, under-provisioned, or optimized. It considers CPU, memory, network, and EBS throughput. For production workloads, enable enhanced infrastructure metrics (requires CloudWatch detailed monitoring) to get recommendations based on 1-minute granularity instead of 5-minute. Compute Optimizer also supports Auto Scaling groups and Lambda functions. The recommendations include estimated monthly savings and performance risk. In practice, we've seen that Compute Optimizer tends to be conservative with memory recommendations; always validate with load testing before resizing. The service is free for EC2, Auto Scaling groups, and Lambda, but charges for EBS volumes. Use the AWS CLI or SDK to export recommendations to S3 for analysis.

#!/bin/bash
# Get EC2 instance recommendations from Compute Optimizer
aws compute-optimizer get-ec2-instance-recommendations \
    --instance-arns arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678 \
    --query "instanceRecommendations[0].{current:currentInstanceType, recommendation:recommendationOptions[0].instanceType, savings:estimatedMonthlySavings.value}" \
    --output json
# Export all recommendations to S3
aws compute-optimizer export-ec2-instance-recommendations \
    --s3-destination-config bucket=my-bucket,keyPrefix=compute-optimizer/

Combining Trusted Advisor and Compute Optimizer for Maximum Impact

Trusted Advisor and Compute Optimizer complement each other. Trusted Advisor flags idle resources (e.g., load balancers with no traffic, unassociated IPs, underutilized EBS volumes) that can be deleted or downsized immediately. Compute Optimizer focuses on running instances that are over- or under-provisioned. The combined workflow: first, run Trusted Advisor to identify and eliminate waste (low-hanging fruit). Then, use Compute Optimizer to right-size remaining instances. For example, Trusted Advisor might find an idle t3.large instance that can be stopped, saving $30/month. Compute Optimizer might recommend downsizing a running t3.xlarge to t3.large, saving $50/month. In production, we schedule a weekly Lambda that runs both checks, aggregates the savings, and posts to a dashboard. This gives a single view of potential savings. Remember that Trusted Advisor checks are refreshed on a schedule, while Compute Optimizer updates every 12 hours.

import boto3
import json

def lambda_handler(event, context):
    # Trusted Advisor
    support = boto3.client('support', region_name='us-east-1')
    checks = support.describe_trusted_advisor_checks(language='en')['checks']
    cost_checks = [c for c in checks if c['category'] == 'cost_optimizing']
    ta_savings = 0
    for check in cost_checks:
        support.refresh_trusted_advisor_check(check_id=check['id'])
        result = support.describe_trusted_advisor_check_result(check_id=check['id'])
        # Simplified: assume each flagged resource saves $10/month
        flagged = result['result']['resourcesSummary']['resourcesFlagged']
        ta_savings += flagged * 10
    # Compute Optimizer
    optimizer = boto3.client('compute-optimizer', region_name='us-east-1')
    recommendations = optimizer.get_ec2_instance_recommendations()
    co_savings = 0
    for rec in recommendations['instanceRecommendations']:
        if rec['finding'] == 'OVER_PROVISIONED':
            # Take best option savings
            best = rec['recommendationOptions'][0]
            co_savings += best['estimatedMonthlySavings']['value']
    total_savings = ta_savings + co_savings
    # Publish to CloudWatch metric
    cw = boto3.client('cloudwatch')
    cw.put_metric_data(
        Namespace='Optimization',
        MetricData=[
            {'MetricName': 'PotentialMonthlySavings', 'Value': total_savings, 'Unit': 'Count'}
        ]
    )
    return {'total_savings': total_savings}

Automating Remediation with AWS Config and Systems Manager

Once you have recommendations, the next step is automated remediation. For Trusted Advisor, you can use AWS Config rules to detect non-compliant resources and trigger Systems Manager Automation documents. For example, create a Config rule that checks for unassociated Elastic IPs and runs an automation to release them. For Compute Optimizer, you can use AWS Systems Manager to resize instances based on recommendations, but be cautious: always test in a non-production environment first. A safer approach is to use a Lambda function that applies recommendations to instances with a 'canary' tag, then monitors for issues before rolling out widely. In production, we use a two-phase approach: Phase 1 automatically applies recommendations to instances tagged 'auto-optimize', Phase 2 sends a report for manual review for critical instances. This balances automation with safety. Remember to handle instance types that are not available in the same Availability Zone; you may need to stop and start the instance.

import boto3
import json

def lambda_handler(event, context):
    ec2 = boto3.client('ec2', region_name='us-east-1')
    optimizer = boto3.client('compute-optimizer', region_name='us-east-1')
    # Get recommendations for instances with 'auto-optimize' tag
    instances = ec2.describe_instances(
        Filters=[
            {'Name': 'tag:auto-optimize', 'Values': ['true']},
            {'Name': 'instance-state-name', 'Values': ['running']}
        ]
    )
    for reservation in instances['Reservations']:
        for instance in reservation['Instances']:
            instance_arn = f"arn:aws:ec2:us-east-1:123456789012:instance/{instance['InstanceId']}"
            rec = optimizer.get_ec2_instance_recommendations(
                instanceArns=[instance_arn]
            )
            if rec['instanceRecommendations'][0]['finding'] == 'OVER_PROVISIONED':
                new_type = rec['instanceRecommendations'][0]['recommendationOptions'][0]['instanceType']
                # Stop instance, modify, start
                ec2.stop_instances(InstanceIds=[instance['InstanceId']])
                waiter = ec2.get_waiter('instance_stopped')
                waiter.wait(InstanceIds=[instance['InstanceId']])
                ec2.modify_instance_attribute(
                    InstanceId=instance['InstanceId'],
                    InstanceType={'Value': new_type}
                )
                ec2.start_instances(InstanceIds=[instance['InstanceId']])
    return {'status': 'completed'}

Monitoring Savings and Performance Impact

After implementing recommendations, you must monitor both cost savings and performance. Use Cost Explorer to track actual spend vs. projected savings. Create a CloudWatch dashboard that shows metrics like CPUUtilization, MemoryUtilization, and NetworkIn/Out for resized instances. Compare these metrics before and after the change. For Trusted Advisor, track the number of flagged resources over time; a decreasing trend indicates success. For Compute Optimizer, monitor the 'finding' distribution (over-provisioned, under-provisioned, optimized). In production, we set up CloudWatch alarms that trigger if CPU utilization exceeds 80% for 5 minutes after a downsizing, indicating the instance is now under-provisioned. This allows quick rollback. Also, use AWS Budgets to set a monthly cost target and alert if spending deviates. Remember that savings from right-sizing may take a full month to reflect in bills.

#!/bin/bash
# Get cost and usage for a specific EC2 instance over time
aws ce get-cost-and-usage \
    --time-period Start=2023-01-01,End=2023-01-31 \
    --granularity DAILY \
    --filter "{\"Dimensions\": {\"Key\": \"INSTANCE_TYPE\", \"Values\": [\"t3.medium\"]}}" \
    --metrics "BlendedCost" "UsageQuantity"
# Get CloudWatch metrics for CPU utilization
aws cloudwatch get-metric-statistics \
    --namespace AWS/EC2 \
    --metric-name CPUUtilization \
    --dimensions Name=InstanceId,Value=i-0abcd1234efgh5678 \
    --start-time 2023-01-01T00:00:00Z \
    --end-time 2023-01-31T23:59:59Z \
    --period 3600 \
    --statistics Average

Handling Reserved Instances and Savings Plans

Trusted Advisor includes checks for Reserved Instance (RI) utilization and expiration. Compute Optimizer does not directly handle RIs, but its recommendations can inform RI purchases. For example, if Compute Optimizer recommends a consistent instance type across your fleet, consider purchasing RIs or Savings Plans for that type. Trusted Advisor will alert you when RIs are about to expire, giving you time to renew. In production, we use a combination: buy Convertible RIs for baseline capacity and use Savings Plans for variable workloads. This provides flexibility while maximizing discounts. Always analyze your usage patterns over the past 30 days before committing. Use the AWS Cost Explorer RI report to see utilization and coverage. Remember that RIs are region-specific and instance-type-specific (except for Convertible RIs which can be exchanged).

#!/bin/bash
# Get RI utilization from Cost Explorer
aws ce get-reservation-utilization \
    --time-period Start=2023-01-01,End=2023-01-31 \
    --granularity MONTHLY \
    --query "UtilizationsByTime[0].Total.{utilization:UtilizationPercentage, coverage:CoveragePercentage}"

Extending Optimization to EBS and Lambda

Trusted Advisor checks for underutilized EBS volumes (low I/O and size). Compute Optimizer also provides EBS volume recommendations. For Lambda, Compute Optimizer recommends memory size adjustments based on duration and cost. To optimize EBS, identify volumes with less than 1 IOPS per GB and low throughput, then consider downsizing or changing to gp3 (which offers baseline performance independent of size). For Lambda, use Compute Optimizer to find functions that are over- or under-provisioned in memory. Increasing memory can reduce duration and cost due to faster execution. In production, we automated EBS volume modification using a Lambda that checks Trusted Advisor results and modifies volumes with a 'can-modify' tag. For Lambda, we use a custom script that updates function memory based on Compute Optimizer recommendations and tests with a canary invocation.

import boto3
import json

def lambda_handler(event, context):
    # EBS optimization
    ec2 = boto3.client('ec2', region_name='us-east-1')
    volumes = ec2.describe_volumes(
        Filters=[
            {'Name': 'tag:auto-optimize', 'Values': ['true']},
            {'Name': 'status', 'Values': ['available']}
        ]
    )
    for vol in volumes['Volumes']:
        # Simple heuristic: if size > 100GB and IOPS < 100, downsize
        if vol['Size'] > 100 and vol['Iops'] < 100:
            new_size = vol['Size'] // 2
            ec2.modify_volume(VolumeId=vol['VolumeId'], Size=new_size)
    # Lambda optimization
    client = boto3.client('compute-optimizer')
    recommendations = client.get_lambda_function_recommendations()
    for rec in recommendations['lambdaFunctionRecommendations']:
        if rec['finding'] == 'OVER_PROVISIONED':
            new_memory = rec['recommendationOptions'][0]['memorySize']
            # Update function memory
            lmbda = boto3.client('lambda')
            lmbda.update_function_configuration(
                FunctionName=rec['functionArn'],
                MemorySize=new_memory
            )
    return {'status': 'completed'}

Governance and Multi-Account Strategy

In organizations with multiple AWS accounts, centralizing Trusted Advisor and Compute Optimizer is critical. Use AWS Organizations to aggregate recommendations across accounts. Trusted Advisor can be accessed via the AWS Support API from a central account if you have the necessary cross-account roles. Compute Optimizer supports multi-account management via the console or API by specifying the account IDs. For governance, create a custom dashboard using Amazon QuickSight that pulls data from Trusted Advisor and Compute Optimizer across all accounts. Use AWS Config aggregator to view compliance across accounts. In production, we have a monthly review meeting where each account owner presents their optimization status. We also enforce tagging standards so that cost and optimization data can be sliced by team or project. Without governance, optimization efforts become fragmented and savings are missed.

#!/bin/bash
# Assume role in each account and get Compute Optimizer recommendations
for account in "111111111111" "222222222222"; do
    role_arn="arn:aws:iam::${account}:role/OptimizationRole"
    credentials=$(aws sts assume-role --role-arn $role_arn --role-session-name optimizer)
    export AWS_ACCESS_KEY_ID=$(echo $credentials | jq -r '.Credentials.AccessKeyId')
    export AWS_SECRET_ACCESS_KEY=$(echo $credentials | jq -r '.Credentials.SecretAccessKey')
    export AWS_SESSION_TOKEN=$(echo $credentials | jq -r '.Credentials.SessionToken')
    aws compute-optimizer get-enrollment-status
    aws compute-optimizer get-ec2-instance-recommendations --query "instanceRecommendations[?finding=='OVER_PROVISIONED']"
done

Continuous Improvement and Culture

Optimization is not a one-time project; it's a continuous process. Set up weekly or monthly reviews of Trusted Advisor and Compute Optimizer recommendations. Use AWS Budgets to track actual spend against targets. Encourage a culture of cost awareness by sharing savings metrics with the team. In production, we gamify optimization: each team gets a monthly score based on percentage of resources optimized. We also have a 'cost champion' rotation. Use tools like AWS Well-Architected Framework to regularly review your architecture. Remember that optimization can also improve performance: right-sizing can reduce latency and increase throughput. Finally, always test changes in a staging environment and have a rollback plan. The goal is to reduce waste without sacrificing reliability.