Welcome back to BackSpace Academy. In this lecture I'm going to give you a 2
quick overview of the trusted adviser service of AWS now what that is it is a 3
online service that will audit your infrastructure against best practices 4
across a number of different areas being cost optimization performance security 5
fault tolerance and service limits now make sure that you remember those 6
because it may come up on the exam now depending on what level of support 7
you've got with AWS will determine how detailed the trusted advisor report will 8
be so this account here has enterprise level support from AWS so it has all of 9
the available recommendations from trusted advisor but if you've just got a 10
standard account it will have the majority of these will be grayed out but 11
you will have the essential ones there so don't be too concerned if everything 12
is not there and available for you it just means that you haven't you haven't 13
got that level of support from AWS so looking at the first one here we've got 14
cost optimization and so everything is with a green tick so there's nothing for 15
us to be concerned about but I can click on that and have a bit of a closer look 16
at it so we can see there it's looking for idle DB instances or ec2 instances 17
or any sort of instance that we're not using we need to get rid of those and 18
save the money we can see their idle load balances ec2 instances that are not 19
utilized fully and they can go to a smaller ec2 instance unassociated 20
elastic IP addresses so there's quite a bit of stuff there that it can recommend 21
for us that can save us quite a bit of money and not only that is that we can 22
actually expand these and it will tell us exactly where these resources are so 23
that can be quite difficult to track those down sometimes but this will make 24
life a lot easier for you trusted advisor can also advise us on 25
performance how we can reduce the bottlenecks in our infrastructure how we 26
can reduce sale cost with resource record sets in 27
Amazon route 53 how we can use cloud front in front of our our buckets to 28
minimize our costs for delivery of that content in security there's also a lot 29
of areas that we can look into right here we've got everything in green but 30
we've also got two which are actually alerting us to a problem so we can see 31
down here we've got we don't have cloud trail logging on any of the regions here 32
so that's something we'd want to implement we also have some security 33
groups that have unrestricted access so let's have a look at those so I can see 34
here when I've created a wordpress ami or use the WordPress ami for a lab it's 35
create a security group and by default it's just had that open on port 22 for 36
for all IP so we can now just click on that and it'll take a straight there 37
where it is so we can see there here are these two security groups and they're 38
being created for that WordPress ami so if we have a look at that and we can see 39
there we've got SSH and we use SSH or secure shell to connect directly into 40
the Linux operating system of an instance and we can see they're on port 41
22 it's open for everyone so that's not desirable it's not a major deal but it 42
is not desirable to have that and so we can edit that and we can change that to 43
our IP so the only way of accessing over secure shell will be from our own IP 44
address anything else outside of our IP address will not be allowed but that 45
said you still need AWS credentials to actually get in anyway but again it's 46
not a good practice and you should have that lock down as well so what I'm going 47
to do is just delete those 48
so they've gone now so what go back to trusted advisor and if i refresh this 49
one that should no longer be a warning 50
okay so after a short amount of time those that warning for that alert for 51
those security groups has now disappeared so we don't have to worry 52
about that anymore so let's go to fault tolerance and here 53
we can see we've got two warnings here for s3 bucket logging and also for 54
versioning on our bucket so it's not it's not a major deal but it's something 55
that it's recommending we should do we should have versioning on a bucket 56
that's that's certainly a best practice and finally we got service limits so if 57
we're exceeding our service limits that's going to cause problems for us if 58
we're exceeding the number of instances that that you know that we should have 59
then we're going to have a problem when we go to launch instances but you can 60
see there we've got no problems there but it goes through a whole heap of 61
different stuff there to make sure that you're not exceeding the service limits 62
for example elastic IP address so if you're getting close to that then it all 63
warned you that there is a problem with that so that's the trusted advisor 64
service so make sure that you go to it and the way you get there is go to 65
services and trusted advisor quite simply and and again your trusted 66
advisor won't be as complete as this one if you don't have enterprise support 67
from AWS but still it's a good idea to go and have a look at it and just see 68
how it all works so that's it and I'll see you in the next step