> ## Documentation Index
> Fetch the complete documentation index at: https://cloud-architect.ipoint-labs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Check AWS Resources in Trusted Advisor
> Hands-on lab · 45m
Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console.
Open IP Lab Portal
## Overview
### Lab details
1. This lab walks you through the steps to monitor the unrestricted security groups and public S3 Buckets with the help of AWS Trusted Advisor.
2. Duration: **60 minutes**
3. AWS Region: **US East (N. Virginia) us-east-1**
### Introduction
#### What is AWS Trusted Advisor ?
* AWS Trusted Advisor is an automated cloud service provided by Amazon Web Services (AWS).It offers real-time guidance and recommendations to help customers optimize their AWS infrastructure.
* Trusted Advisor analyzes an organization's AWS resources and configurations.It compares the resources against AWS best practices and industry standards.
* Trusted Advisor provides actionable insights to improve security, performance, and cost efficiency.
* It covers various categories, including cost optimization, performance, security, fault tolerance, and service limits.
* The service continuously monitors the customer's AWS environment for potential issues and optimization opportunities.
* Trusted Advisor sends proactive notifications and alerts to keep customers informed about their infrastructure health.
* It offers personalized recommendations tailored to the specific AWS resources and configurations used by each customer.
* Trusted Advisor helps identify idle resources, underutilized instances, security vulnerabilities, and other optimization opportunities.
* Customers can access Trusted Advisor through the AWS Management Console.
* It integrates with other AWS services and third-party tools for enhanced functionality and integration options.
* Trusted Advisor is available to AWS customers with an Enterprise-level support plan at no additional cost.
### Architecture diagram
### Task details
1. Sign in to AWS Management Console
2. Checking the Initial status of the Trusted advisor dashboard
3. Create a first unrestricted security group
4. Create a second unrestricted security group
5. Creating 2 Public S3 Buckets
6. Refresh the Trusted advisor dashboard
7. Validation of the lab
8. Disable the Trusted Advisor
### Launching the lab environment
1. To launch the lab environment, Click on the **Launch lab** button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with **IAM user name**, **Password**, **Access** **Key**, and **Secret** **Access** **Key**.
You can only start one lab at any given time
## Lab guide
### Lab steps
### Task 1: Sign in to AWS Management Console
1. Click on the **Open console** button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
* Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
* Now copy your **User Name** and **Password** in the Lab Console to the **IAM Username and Password** in AWS Console and click on the **Sign in** button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as **US East (N. Virginia) us-east-1.**
#### Task 2: Checking the initial status of the Trusted advisor dashboard
In this task, we will check the initial status of the Trusted advisor dashboard.
1. Make sure you are in **US East (N. Virginia) us-east-1** Region.
2. Navigate to **Trusted Advisor** by clicking on the **Services** menu at the top, then click on **Trusted Advisor** in the **Management & Governance** section.
3. On the home page of Trusted Advisor, we have the Dashboard. You can here check recommendations to optimize your services and resources.
4. By default, as you open the page all the recommendation actions will refresh automatically to fetch the latest results.
5. We will create 2 unrestricted security groups and 2 public S3 buckets to understand more about Trusted Advisor.
#### Task 3: Create 2 unrestricted Security Groups:
In this task, we will create two unrestricted security groups by enabling the SSH rule.
1. Navigate to **EC2** by clicking on the **Services** menu available under the **Compute** section.
2. On the left panel menu, Select the **Security groups** under the **Network & Security** section.
3. Click on the **Create security group** button.
* Security group name: Enter ***Security Group 1***
* Description: Enter ***First Security group***
* VPC: Select **Default VPC**
* Click on the **Add rule** button under **Inbound rules.**
* Type : Select **SSH**
* Source : Select **Anywhere-IPv4**. In the textbox, it will be automatically populate as **0.0.0.0/0**
4. Leave everything as default and click on the **Create security group** button.
5. Security group named **Security group 1** is now created.
6. On the left panel menu, select the **Security groups** under the **Network & Security** section.
7. Click on the **Create security group** button again.
* Security group name: Enter ***Security Group 2***
* Description: Enter ***Second Security group***
* VPC: Select **Default VPC**
* Click on the **Add rule** button under **Inbound rules.**
* Type : Select **SSH**
* Source : Select **Anywhere-IPv4**. In the textbox, it will be automatically populate as **0.0.0.0/0**
8. Leave everything as default and click on the **Create security group** button.
9. Security group named **Security group 2** is now created.
#### Task 4: Creating 2 Public S3 Buckets
1. Navigate to the **Services** menu at the top and click on **S3** in the **Storage** section.
2. Click on **Create bucket** button and fill in the bucket details.
* Bucket Name: Enter ***demowhizfirstXXXX (where XXXX could be numbers).***
The bucket name must be unique across all existing bucket names in Amazon S3.
* Bucket settings for Block Public Access: **Uncheck** the option of **Block** **all public access** and Select the **check box option of Acknowledgment**.
Making the bucket public is required for this lab.
* Leave other settings as default.
* Click on the **Create bucket** button.
3. Your S3 Bucket is now created.
If you encounter the following error after clicking 'Create Bucket,' please disregard it.
4. Click on the bucket name.
5. Click on the **Permissions** tab to configure your bucket.
* Scroll down to the Bucket Policy section and click the Edit button.
* You will be able to see a Blank policy editor.
* Before creating the policy, you will need to copy the ARN (Amazon Resource Name) of your bucket.
* Copy the **ARN** of your bucket to the clipboard. It is displayed at the top of the policy editor. it looks like **ARN:“arn:aws:s3:::your-bucket-name**".
* In the policy below, update the bucket ARN on the Resource key value, copy and paste it in the policy code.
```plaintext theme={null}
{
"Id":"Policy1",
"Version":"2012-10-17",
"Statement":[
{
"Sid":"Stmt1",
"Action":[
"s3:GetObject"
],
"Effect":"Allow",
"Resource":"replace-this-string-with-your-bucket-arn/*",
"Principal":"*"
}
]
}
```
6. Click on **Save changes** button.
7. Create another S3 Bucket now, follow the same steps as above(including the code) and name the bucket as ***demowhizsecondXXXX (where XXXX could be numbers).***
8. Don't forget to **make them public**.
9. Both the required buckets are created now as we can see in the image given below.
#### Task 5: Refresh the Trusted advisor dashboard
1. Navigate to **Trusted Advisor** by clicking on the **Services** menu at the top, then click on **Trusted Advisor** in the **Management & Governance** section.
2. AWS has a default time cycle after it automatically refreshes all the checks. The new resources that are created may take up to 5- 10 minutes to display in the **Dashboard**.
3. Refresh will take up to 2 minutes, after that it will show all the flagged and unsecured resources. If it still doesn't show, hard refresh the tab once.
4. Optionally, you can click on the download report button to view the report in the excel file.
5. Unlike the refresh button, the download option is available with a dashboard and specific resource action.
6. Refresh all checks button will greyed out once recommendation appears in check summary.
7. It will again appear when new checks summary found.
> #### Do you know ?
>
> AWS Trusted Advisor is available to AWS customers with an Enterprise-level support plan at no additional cost. This means that customers who have subscribed to AWS Enterprise Support can leverage the benefits of Trusted Advisor as part of their support package.
#### Task 6: Validation Test
1. Once the lab steps are completed, please click on the **Check my work** button on the Right side panel and re-click **Check my work** button.
2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not.
3. Sample output:
#### Task 7: Disable the Trusted Advisor
1. Go to **Manage Trusted Advisor** under **Preferences** and click the Enabled button.
2. Select **Disable** in the popup message.
### Completion and conclusion
1. You have successfully created 2 unrestricted EC2 Security Group.
2. You have successfully created 2 public S3 buckets.
3. You have successfully checked resources in the Trusted adviser dashboard.
4. You have successfully validated the lab.
5. You have successfully disabled the Trusted Advisor.
### End lab
1. Sign out of AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps, click on **End lab** in the IP Lab Portal and wait till the process gets completed.
## What gets checked
When you press **Check my work**, the platform verifies each of these:
* **Create Public AWS S3 Bucket** — Check whether a Public S3 Bucket created or not