Controlling Access to the Trusted Advisor Console

The AWS Trusted Advisor console introduces new ways to control access to Trusted Advisor checks by adding new AWS Identity and Access Management (IAM) features. To view Trusted Advisor results or take actions such as refreshing check data or excluding items from results, an IAM user must have permission for actions and resources specified with the "trustedadvisor" namespace. For complete information about creating policies and applying them to users and groups, see the AWS Identity and Access Management documentation.

The trustedadvisor namespace does not apply to the Trusted Advisor actions of the AWS Support API. Permissions for the API are controlled by IAM policies that include actions and resources specified with the "support" IAM namespace. For more information, see the AWS Support User Guide.

The following table shows common permission scenarios for the Trusted Advisor console.

Table 1: Common Permission Scenarios

Access	Specification	AWS managed policy
Full	"Action": "trustedadvisor:", "Resource": ""	AdministratorAccess PowerUserAccess
Read-only	"Action": "trustedadvisor:Describe", "Resource": ""	ReadOnlyAccess
Specific check category	"Resource": "arn:aws:trustedadvisor::acct:checks/category/"	None; see Categories of Checks
Specific check	"Resource": "arn:aws:trustedadvisor::acct:checks/category/checkID*"	None; see Specific Checks
Specific action	"Action": "trustedadvisor:actionName"	None; see Specific Actions

Information That Trusted Advisor Displays

Trusted Advisor displays information about some of the resources that are associated with an AWS account.

Important: Although the user cannot make changes to these resources unless they are authorized to do so by policies that explicitly allow it, the user can view information that they might otherwise not be authorized to view. For example, a user viewing a check related to Amazon EC2 Instances might see information or usage data for instances, even if another policy specifically denies access to viewing this information.

The following two tables show the information that Trusted Advisor displays:

Table 2 shows the title, category, ID, and report columns of the current Trusted Advisor checks. You use the category and check ID to refer to specific checks in an IAM policy.
Table 3 shows examples of service-specific actions (APIs) and data that correspond to the information that is shown by the checks.

Although the list of report columns in the following tables can alert you to information that is exposed by a check, you should examine a Trusted Advisor report for your account to make sure you fully understand what information is exposed by each check.

Table 2: Check Categories, IDs, and Report Columns

Check title	Category	Check ID	Report columns
Amazon EBS Provisioned IOPS Volume Attachment Configuration	Performance	PPkZrjsH2q	Region/AZ \| Volume ID \| Volume Name \| Volume Attachment \| Instance ID \| Instance Type \| EBS Optimized \| Status
Amazon EBS Snapshots	Fault Tolerance	H7IgTzjTYb	Region \| Volume ID \| Volume Name \| Snapshot ID \| Snapshot Name \| Snapshot Age \| Volume Attachment \| Status \| Reason
Amazon EC2 Availability Zone Balance	Fault Tolerance	wuy7G1zxql	Region \| Instances in Zone a \| Instances in Zone b \| Instances in Zone c \| Instances in Zone d \| Instances in Zone e \| Status \| Reason
Amazon EC2 Reserved Instances Optimization	Cost Optimization	1MoPEMsKx6	Region / AZ \| Instance Type \| Operating System \| Current RIs (1-Year and 3-Year) \| Hourly Instance Usage Max/Average/Min \| Recommended Additional 1-Year RIs \| Estimated Bill (Current RIs) \| Upfront Cost \| Estimated Bill (Optimized RIs) \| Estimated Monthly Savings \| Region / AZ \| Instance Type \| Operating System \| Current RIs (1-Year and 3-Year) \| Hourly Instance Usage Max/Average/Min \| Recommended Additional 3-Year RIs \| Estimated Bill (Current RIs) \| Upfront Cost \| Estimated Bill (Optimized RIs) \| Estimated Monthly Savings
Amazon RDS Backups	Fault Tolerance	opQPADkZvH	Region/AZ \| DB Instance \| VPC ID \| Backup Retention Period \| Status
Amazon RDS Idle DB Instances	Cost Optimization	Ti39halfu8	Region \| DB Instance Name \| Multi-AZ \| Instance Type \| Storage Provisioned (GB) \| Days Since Last Connection \| Estimated Monthly Savings (On Demand)
Amazon RDS Multi-AZ	Fault Tolerance	f2iK5R6Dep	Region/AZ \| DB Instance \| VPC ID \| Multi-AZ \| Status
Amazon RDS Security Group Access Risk	Security	nNauJisYIT	Region \| RDS Security Group Name \| Ingress Rule \| Status \| Reason
Amazon Route 53 Alias Resource Record Sets	Performance	B913Ef6fb4	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name \| Resource Record Set Type \| Resource Record Set Identifier \| Alias Target \| Status
Amazon Route 53 Deleted Health Checks	Fault Tolerance	Cb877eB72b	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name \| Resource Record Set Type \| Resource Record Set Identifier
Amazon Route 53 Failover Resource Record Sets	Fault Tolerance	b73EEdD790	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name \| Resource Record Set Type \| Reason
Amazon Route 53 High TTL Resource Record Sets	Fault Tolerance	C056F80cR3	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name \| Resource Record Set Type \| Resource Record Set ID \| TTL \| Status
Amazon Route 53 Latency Resource Record Sets	Cost Optimization	51fC20e7I2	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name \| Resource Record Set Type
Amazon Route 53 MX and SPF Resource Record Sets	Security	c9D319e7sG	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name
Amazon Route 53 Name Server Delegations	Fault Tolerance	cF171Db240	Hosted Zone Name \| Hosted Zone ID \| Number of Name Server Delegations Used
Amazon S3 Bucket Logging	Fault Tolerance	BueAdJ7NrP	Region \| Bucket Name \| Target Name \| Target Exists \| Same Owner \| Write Enabled \| Status \| Reason
Amazon S3 Bucket Permissions	Security	Pfx0RwqBli	Region Name \| Region API Parameter \| Bucket Name \| Global List Access \| Global Upload/Delete Access \| Status
Auto Scaling Group Health Check	Fault Tolerance	CLOG40CDO8	Region \| Auto Scaling Group Name \| Load Balancer Associated \| Health Check \| Status
Auto Scaling Group Resources	Fault Tolerance	8CNsSllI5v	Region \| Auto Scaling Group Name \| Launch Configuration Name \| Resource Type \| Resource Name \| Status \| Reason
AWS CloudTrail Logging	Security	vjafUGJ9H0	Region \| Trail Name \| Logging Status \| Bucket Name \| Last Delivery Error \| Status
CloudFront Content Delivery Optimization	Performance	796d6f3D83	Region \| Bucket Name \| S3 Storage (GB) \| Data Transfer Out (GB) \| Ratio of Transfer to Storage \| Status
ELB Connection Draining	Fault Tolerance	7qGXsKIUw	Region \| Load Balancer Name \| Status \| Reason
ELB Cross-Zone Load Balancing	Fault Tolerance	xdeXZKIUy	Region \| Load Balancer Name \| Status \| Reason
ELB Listener Security	Security	a2sEc6ILx	Region \| Load Balancer Name \| Load Balancer Port \| Status [Ciphers/Protocols] \| Reason
ELB Security Groups	Security	xSqX82fQu	Region \| Load Balancer Name \| Status \| Security Group IDs \| Reason
High Utilization Amazon EC2 Instances	Performance	ZRxQlPsb6c	Region/AZ \| Instance ID \| Instance Name \| Instance Type \| Day 1 ... Day 14 \| 14-Day Average CPU Utilization \| Number of Days over 90% CPU Utilization
IAM Password Policy	Security	Yw2K9puPzl	Password Policy \| Uppercase \| Lowercase \| Number \| Non-alphanumeric \| Status \| Reason
IAM Use	Security	zXCkfM1nI3	[None]
Idle Load Balancers	Cost Optimization	hjLMh88uM8	Region \| Load Balancer Name \| Reason \| Estimated Monthly Savings
Large Number of EC2 Security Group Rules Applied to an Instance	Performance	j3DFqYTe29	Region \| Instance ID \| Instance Name \| VPC ID \| Total Inbound Rules \| Total Outbound Rules
Large Number of Rules in an EC2 Security Group	Fault Tolerance	tfg86AVHAZ	Region \| Security Group Name \| Group ID \| Description \| Instance Count \| VPC ID \| Total Inbound Rules \| Total Outbound Rules
Load Balancer Optimization	Fault Tolerance	iqdCTZKCUp	Region \| Load Balancer Name \| # of Zones \| Instances in Zone a \| Instances in Zone b \| Instances in Zone c \| Instances in Zone d \| Instances in Zone e \| Status \| Reason
Low Utilization Amazon EC2 Instances	Cost Optimization	Qch7DwouX1	Region/AZ \| Instance ID \| Instance Name \| Instance Type \| Estimated Monthly Savings \| Day 1 ... Day 14 \| 14-Day Average CPU Utilization \| 14-Day Average Network I/O \| Number of Days Low Utilization
MFA on Root Account	Security	7DAFEmoDos	[None]
Overutilized Standard Amazon EBS Volumes	Performance	k3J2hns32g	Region \| Volume ID \| Volume Name \| Day 1 ... Day 14 \| Number of Days Over \| Max Daily Median \| Status
Security Groups - Specific Ports Unrestricted	Security	HCP4007jGY	Region \| Security Group Name \| Security Group ID \| Protocol \| Status \| Ports
Security Groups - Unrestricted Access	Security	1iG5NDGVre	Region \| Security Group Name \| Security Group ID \| Protocol \| Port \| Status \| IP Range
Service Limits	Performance	eW7HH0l7J9	Region \| Service \| Limit Name \| Limit Amount \| Current Usage \| Status
Unassociated Elastic IP Addresses	Cost Optimization	Z4AUBRNSmz	Region \| IP Address
Underutilized Amazon EBS Volumes	Cost Optimization	DAvU99Dc4C	Region \| Volume ID \| Volume Name \| Volume Type \| Volume Size \| Monthly Storage Cost \| Snapshot ID \| Snapshot Name \| Snapshot Age
VPN Tunnel Redundancy	Fault Tolerance	S45wrEXrLz	Region \| VPN ID \| VPC \| Virtual Private Gateway \| Customer Gateway \| Active Tunnels \| Status \| Reason

The following table shows the report columns for each check again, adding examples of the service-specific actions that display data that corresponds to the data displayed in the Trusted Advisor report columns. Note that Trusted Advisor does not necessarily use the actions listed; the actions are only examples of one way to display the information.

For example, if you deny a user access to the Amazon EC2 DescribeInstances operation but also allow the user access to the Trusted Advisor Low Utilization EC2 Instances check, the user can view some of the information that is returned by DescribeInstances, even though access to DescribeInstances has been explicitly denied.

Table 3: Example Actions and Data

Check title	Report columns	Actions	Data
Amazon EBS Provisioned IOPS Volume Attachment Configuration	Region/AZ \| Volume ID \| Volume Name \| Volume Attachment \| Instance ID \| Instance Type \| EBS Optimized \| Status	ec2:DescribeVolumes	AvailabilityZone VolumeId tag:Name VolumeType AttachmentSet.Item.VolumeId AttachmentSet.Item.InstanceId AttachmentSet.Item.Device
Amazon EBS Provisioned IOPS Volume Attachment Configuration		ec2:DescribeInstanceAttribute	InstanceId EbsOptimized
Amazon EBS Snapshots	Region \| Volume ID \| Volume Name \| Snapshot ID \| Snapshot Name \| Snapshot Age \| Volume Attachment \| Status \| Reason	ec2:DescribeVolumes	VolumeId VolumeType tag:Name
Amazon EBS Snapshots		cloudwatch:GetMetricStatistics	VolumeReadOps VolumeWriteOps
Amazon EC2 Availability Zone Balance	Region \| Instances in Zone a \| Instances in Zone b \| Instances in Zone c \| Instances in Zone d \| Instances in Zone e \| Status \| Reason	ec2:DescribeInstances	AvailabilityZone
Amazon EC2 Reserved Instances Optimization	Region / AZ \| Instance Type \| Operating System \| Current RIs (1-Year and 3-Year) \| Hourly Instance Usage Max/Average/Min \| Recommended Additional 1-Year RIs \| Estimated Bill (Current RIs) \| Upfront Cost \| Estimated Bill (Optimized RIs) \| Estimated Monthly Savings \| Region / AZ \| Instance Type \| Operating System \| Current RIs (1-Year and 3-Year) \| Hourly Instance Usage Max/Average/Min \| Recommended Additional 3-Year RIs \| Estimated Bill (Current RIs) \| Upfront Cost \| Estimated Bill (Optimized RIs) \| Estimated Monthly Savings	ec2:DescribeReservedInstances	AvailabilityZone InstanceType ProductDescription Duration
Amazon RDS Backups	Region/AZ \| DB Instance \| VPC ID \| Backup Retention Period \| Status	rds:DescribeDBInstances	AvailabilityZone DBInstanceIdentifier DBSubnetGroup.VpcId BackupRetentionPeriod
Amazon RDS Idle DB Instances	Region \| DB Instance Name \| Multi-AZ \| Instance Type \| Storage Provisioned (GB) \| Days Since Last Connection \| Estimated Monthly Savings (On Demand)	rds:DescribeDBInstances	DBInstanceIdentifier MultiAZ DBInstanceClass AllocatedStorage
Amazon RDS Idle DB Instances		cloudwatch:GetMetricStatistics	DatabaseConnections
Amazon RDS Multi-AZ	Region/AZ \| DB Instance \| VPC ID \| Multi-AZ \| Status	rds:DescribeDBInstances	AvailabilityZone DBInstanceIdentifier DBSubnetGroup.VpcId MultiAZ
Amazon RDS Security Group Access Risk	Region \| RDS Security Group Name \| Ingress Rule \| Status \| Reason	rds:DescribeDBInstances	DBSecurityGroupName
Amazon RDS Security Group Access Risk		rds:DescribeDBSecurityGroups	IPRanges
Amazon Route 53 Alias Resource Record Sets	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name \| Resource Record Set Type \| Resource Record Set Identifier \| Alias Target \| Status	route53:ListResourceRecordSets	HostedZoneId Name Type DNSName SetIdentifier
Amazon Route 53 Alias Resource Record Sets		route53:ListHostedZones	Name
Amazon Route 53 Deleted Health Checks	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name \| Resource Record Set Type \| Resource Record Set Identifier	route53:ListResourceRecordSets	HostedZoneId Name Type SetIdentifier
Amazon Route 53 Deleted Health Checks		route53:ListHostedZones	Name
Amazon Route 53 Failover Resource Record Sets	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name \| Resource Record Set Type \| Reason	route53:ListResourceRecordSets	HostedZoneId Name Type
Amazon Route 53 Failover Resource Record Sets		route53:ListHostedZones	Name
Amazon Route 53 High TTL Resource Record Sets	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name \| Resource Record Set Type \| Resource Record Set ID \| TTL \| Status	route53:ListResourceRecordSets	HostedZoneId Name Type SetIdentifier TTL
Amazon Route 53 High TTL Resource Record Sets		route53:ListHostedZones	Name
Amazon Route 53 Latency Resource Record Sets	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name \| Resource Record Set Type	route53:ListResourceRecordSets	HostedZoneId Name Type
Amazon Route 53 Latency Resource Record Sets		route53:ListHostedZones	Name
Amazon Route 53 MX and SPF Resource Record Sets	Hosted Zone Name \| Hosted Zone ID \| Resource Record Set Name	route53:ListResourceRecordSets	HostedZoneId Name
Amazon Route 53 MX and SPF Resource Record Sets		route53:ListHostedZones	Name
Amazon Route 53 Name Server Delegations	Hosted Zone Name \| Hosted Zone ID \| Number of Name Server Delegations Used	route53:ListHostedZones	Name ID NameServers
Amazon S3 Bucket Logging	Region \| Bucket Name \| Target Name \| Target Exists \| Same Owner \| Write Enabled \| Status \| Reason	s3:GetService	BucketName Owner
		s3:GetBucketLogging	TargetName
		s3:GetBucketAcl	Grantee Permission
Amazon S3 Bucket Permissions	Region Name \| Region API Parameter \| Bucket Name \| Global List Access \| Global Upload/Delete Access \| Status	s3:GetService	BucketName Owner
Amazon S3 Bucket Permissions		s3:GetBucketAcl	Grantee Permission
Auto Scaling Group Health Check	Region \| Auto Scaling Group Name \| Load Balancer Associated \| Health Check \| Status	autoscaling: DescribeAutoScalingGroups	AutoScalingGroupARN AutoScalingGroupName LoadBalancerNames HealthCheckType
Auto Scaling Group Resources	Region \| Auto Scaling Group Name \| Launch Configuration Name \| Resource Type \| Resource Name \| Status \| Reason	autoscaling: DescribeAutoScalingGroups	AutoScalingGroupARN AutoScalingGroupName LaunchConfigurationName LoadBalancerNames
Auto Scaling Group Resources		autoscaling: DescribeLaunchConfiguration	ImageId
AWS CloudTrail Logging	Region \| Trail Name \| Logging Status \| Bucket Name \| Last Delivery Error \| Status	cloudtrail:DescribeTrails	Name S3BucketName
AWS CloudTrail Logging		cloudtrail:GetTrailStatus	IsLogging LatestDeliveryError
CloudFront Content Delivery Optimization	Region \| Bucket Name \| S3 Storage (GB) \| Data Transfer Out (GB) \| Ratio of Transfer to Storage \| Status	s3:GetBucket	Name Contents.Size
CloudFront Content Delivery Optimization		s3:GetBucket	Name Contents.Size
ELB Connection Draining	Region \| Load Balancer Name \| Status \| Reason	elasticloadbalancing: DescribeLoadBalancers	LoadBalancerName
ELB Connection Draining	Region \| Load Balancer Name \| Status \| Reason	elasticloadbalancing: DescribeLoadBalancerAttributes	LoadBalancerAttributes ConnectionDraining
ELB Cross-Zone Load Balancing	Region \| Load Balancer Name \| Status \| Reason	elasticloadbalancing: DescribeLoadBalancers	LoadBalancerName
ELB Cross-Zone Load Balancing	Region \| Load Balancer Name \| Status \| Reason	elasticloadbalancing: DescribeLoadBalancerAttributes	LoadBalancerAttributes CrossZoneLoadBalancing
ELB Listener Security	Region \| Load Balancer Name \| Load Balancer Port \| Status [Ciphers/Protocols] \| Reason	elasticloadbalancing: DescribeLoadBalancers	LoadBalancerName Listener.LoadBalancerPort Listener.Protocol
ELB Security Groups	Region \| Load Balancer Name \| Status \| Security Group IDs \| Reason	elasticloadbalancing: DescribeLoadBalancers	LoadBalancerName SecurityGroups
High Utilization Amazon EC2 Instances	Region/AZ \| Instance ID \| Instance Name \| Instance Type \| Day 1 ... Day 14 \| 14-Day Average CPU Utilization \| Number of Days over 90% CPU Utilization	ec2:DescribeInstances	AvailabilityZone InstanceId tag:Name
High Utilization Amazon EC2 Instances		cloudwatch:GetMetricStatistics	CPUUtilization NetworkIn NetworkOut
IAM Password Policy	Password Policy \| Uppercase \| Lowercase \| Number \| Non-alphanumeric \| Status \| Reason	iam:GetAccountPasswordPolicy	RequireUppercaseCharacters RequireLowercaseCharacters RequireNumbers RequireSymbols
IAM Use	[None]	iam:GetAccountSummary	Users Groups
IAM Use	[None]	iam:ListRoles	Roles
Idle Load Balancers	Region \| Load Balancer Name \| Reason \| Estimated Monthly Savings	elasticloadbalancing: DescribeLoadBalancers	LoadBalancerName Instances
		elasticloadbalancing: DescribeInstanceHealth	InstanceStates
		cloudwatch:GetMetricStatistics	AWS/ELB/RequestCount
Large Number of EC2 Security Group Rules Applied to an Instance	Region \| Instance ID \| Instance Name \| VPC ID \| Total Inbound Rules \| Total Outbound Rules	ec2:DescribeInstances ec2:DescribeGroups	InstanceId tag:Name VpcId GroupId GroupName
		ec2:DescribeGroups	IpPermissions IpPermissionsEgress
Large Number of Rules in an EC2 Security Group	Region \| Security Group Name \| Group ID \| Description \| Instance Count \| VPC ID \| Total Inbound Rules \| Total Outbound Rules	ec2:DescribeGroups	GroupName GroupId GroupDescription VpcId IpPermissions IpPermissionsEgress
Large Number of Rules in an EC2 Security Group		ec2:DescribeInstances	GroupId InstanceId
Load Balancer Optimization	Region \| Load Balancer Name \| # of Zones \| Instances in Zone a \| Instances in Zone b \| Instances in Zone c \| Instances in Zone d \| Instances in Zone e \| Status \| Reason	elasticloadbalancing: DescribeLoadBalancers	LoadBalancerName AvailabilityZones
Low Utilization Amazon EC2 Instances	Region/AZ \| Instance ID \| Instance Name \| Instance Type \| Estimated Monthly Savings \| Day 1 ... Day 14 \| 14-Day Average CPU Utilization \| 14-Day Average Network I/O \| Number of Days Low Utilization	ec2:DescribeInstances	AvailabilityZone InstanceID tag:Name
Low Utilization Amazon EC2 Instances		cloudwatch:GetMetricStatistics	CPUUtilization NetworkIn NetworkOut
MFA on Root Account	[None]	iam:GetAccountSummary	AccountMFAEnabled
Overutilized Standard Amazon EBS Volumes	Region \| Volume ID \| Volume Name \| Day 1 ... Day 14 \| Number of Days Over \| Max Daily Median \| Status	ec2:DescribeVolumes	VolumeId VolumeType tag:Name
Overutilized Standard Amazon EBS Volumes		cloudwatch:GetMetricStatistics	VolumeReadOps VolumeWriteOps
Security Groups - Specific Ports Unrestricted	Region \| Security Group Name \| Security Group ID \| Protocol \| Status \| Ports	ec2:DescribeSecurityGroups	GroupName GroupId IpPermissions IpProtocol FromPort ToPort
Security Groups - Unrestricted Access	Region \| Security Group Name \| Security Group ID \| Protocol \| Port \| Status \| IP Range	ec2:DescribeSecurityGroups	GroupName GroupId IpPermissions IpProtocol FromPort ToPort IpRanges
Service Limits	Region \| Service \| Limit Name \| Limit Amount \| Current Usage \| Status	[Shows limits and current usage for several services. See "What service limits do you check" in the Trusted Advisor FAQs for details.]	[Varies]
Unassociated Elastic IP Addresses	Region \| IP Address	ec2:DescribeAddresses	PublicIp InstanceId
Unassociated Elastic IP Addresses	Region \| IP Address	ec2:DescribeInstances	InstanceState
Underutilized Amazon EBS Volumes	Region \| Volume ID \| Volume Name \| Volume Type \| Volume Size \| Monthly Storage Cost \| Snapshot ID \| Snapshot Name \| Snapshot Age	ec2:DescribeVolumes	VolumeId VolumeType tag:Name Size
Underutilized Amazon EBS Volumes		ec2:DescribeSnapshots	SnapshotId tag:Name StartTime
VPN Tunnel Redundancy	Region \| VPN ID \| VPC \| Virtual Private Gateway \| Customer Gateway \| Active Tunnels \| Status \| Reason	ec2:DescribeVpnConnections	VpnConnectionId VpnGatewayId CustomerGatewayId VgwTelemetry
VPN Tunnel Redundancy		ec2:DescribeVpnGateways	VpcId

IAM Policy Examples

The following are examples of IAM policies that you might use to control access to the Trusted Advisor console. For more information about how to construct policies, see Overview of AWS IAM Policies in the AWS Identity and Access Management User Guide.

Deny All

The following example policy denies access to all Trusted Advisor check results:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "trustedadvisor:*",
      "Resource": "*"
    }
  ]
}

Allow All

The following example policy allows the user to view (and take all actions on) all Trusted Advisor checks:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "trustedadvisor:*",
      "Resource": "*"
    }
  ]
}

Categories of Checks

To specify a Trusted Advisor check category in a policy, use an Amazon resource name (ARN) in this form:

arn:aws:trustedadvisor:*:accountnumber:checks/categoryCode/*

To see the check categories, see Table 2. The following table shows the category code to specify for each category.

Table 4: Categories and Category Codes

Category	Category code
Cost Optimization	cost_optimizing
Performance	performance
Security	security
Fault Tolerance	fault_tolerance

The following example policy allows the user to view (and perform other actions on) the checks in the Fault Tolerance and Performance categories by specifying the category codes:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Action": "trustedadvisor:*",

"Resource": ["arn:aws:trustedadvisor:*:123456789012:checks/fault_tolerance/*",

"arn:aws:trustedadvisor:*:123456789012:checks/performance/*"]

}

]

}

Specific Checks

To allow or deny permission to a specific Trusted Advisor check in a policy, use an Amazon resource name (ARN) in this form:

arn:aws:trustedadvisor:*:accountnumber:checks/categoryCode/checkId

Categories and IDs are shown in Table 2; category codes are shown in Table 4. You can also retrieve check IDs and categories by using the DescribeTrustedAdvisorChecks action in the AWS Support API.

The following example policy allows the user to view (and perform other actions on) two specific checks related to Amazon S3, by specifying the categories and IDs of those checks:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Action": "trustedadvisor:*",

"Resource": [

"arn:aws:trustedadvisor:*:123456789012:checks/fault_tolerance/BueAdJ7NrP",

"arn:aws:trustedadvisor:*:123456789012:checks/security/Pfx0RwqBli"

]

}

]

}

Specific Actions

You can control the amount of information that a user can see, and you can also control the ability to refresh checks, to exclude and include items from check results, and to view and modify notification preferences.

To allow or deny the use of a specific Trusted Advisor action in a policy, precede the action with the "trustedadvisor:" namespace prefix.

The following table shows the actions you can specify and the result of denying permission for that action.

Table 5: Trusted Advisor Actions

Action	Effect when denied
DescribeCheckSummaries	Cannot view any Trusted Advisor information. Viewing and changing notification preferences is controlled separately.
DescribeCheckItems	Cannot view details (items in results table).
RefreshCheck DescribeCheckRefreshStatuses	Cannot refresh checks. Also cannot change the exclusion or inclusion status of items, because change of item status requires a refresh of the check.
ExcludeCheckItems	Cannot change the status of items from included to excluded. Might be able to change items from excluded to included, depending on the permission for IncludeCheckItems, RefreshCheck, and DescribeCheckRefreshStatuses.
IncludeCheckItems	Cannot change the status of items from excluded to included. Might be able to change items from included to excluded, depending on the permission for ExcludeCheckItems, RefreshCheck, and DescribeCheckRefreshStatuses.
DescribeNotificationPreferences	Cannot view information on the notification preferences page.
UpdateNotificationPreferences	Cannot change options on the notification preferences page.

The following example policy allows the user to view all Trusted Advisor checks, but it does not allow the user to refresh any checks:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "trustedadvisor:*",
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "trustedadvisor:RefreshCheck",
      "Resource": "*"


    }
  ]
}

For more information about how to construct policies, see Overview of AWS IAM Policies in the AWS Identity and Access Management User Guide.