Accelerating Well-Architected Framework reviews using integrated AWS Trusted Advisor insights
AWS Architecture BlogAccelerating Well-Architected Framework reviews using integrated AWS Trusted Advisor insightsby Stephen Salim and Jon Steele | on09 NOV 2022| inArchitecture,AWS Trusted Advisor,AWS Well-Architected Framework,AWS Well-Architected Tool|Permalink|ShareIn this blog, we will explain how the newAWS Well-Architected integration with AWS Trusted Advisorcan give you insights to accelerate your cloud optimization. Customers that have the most success in their cloud adoption recognize that optimizing their cloud architecture and operations is not a one-time effort. Optimization is a continuous improvement virtuous cycle based on learning architectural and operational best practices, measuring workloads against these best practices, and implementing improvements based on opportunities recognized from measurement.Customers can use theAWS Well-Architected Frameworkto build a “learn, measure, and improve” continuous improvement virtuous cycle (Figure 1). With theAWS Well-Architected Tool, customers can measure theirworkloadsagainst these AWS best practices to identify improvement opportunities or risks they should address. After customers complete Well-Architected Framework Reviews (WAFRs) they can generateimprovement planswith prioritized guidance and resources for improvement. They can also track the improvements made over time using themilestonesfeature in the Well-Architected Tool.Figure 1. Continuous optimization of workloads based on AWS best practicesCustomers can add momentum to an AWS Well-Architected “learn, measure, and improve” virtuous cycle using tools that give more insights while measuring workloads. Improved insights result in consistent measurements, that are more efficient and more accurate. This accelerates the optimization cycle by reducing the time required to measure workloads. Collecting information on AWS resources using Trusted Advisor checks allows customers to validate if a workload’s state is aligned with AWS best practices. The new AWS Well-Architected Toolintegration with AWS Trusted Advisormakes it easier and faster to gain insights during WAFRs. The Trusted Advisor checks that are relevant to a specific set of best practices have been mapped to the corresponding questions in Well-Architected. The new feature now shows the mapped Trusted Advisor checks directly in the Well-Architected Tool. These insights help customers run WAFRs in less time, with more accuracy, accelerating the improvement cycle (Figure 2).Figure 2. Insights from AWS Trusted Advisor create acceleration in achieving improved outcomesAWS Well-Architected Tool integration with AWS Trusted Advisor: feature exampleIn the following sections, we detail an example scenario on how to use the integration with Trusted Advisor to gain insights when measuring your workloads.Enabling the AWS Well-Architected Tool integration with AWS Trusted AdvisorHow to enable the new feature in your workload:Create a new workload in the AWS Well-Architected Console. Refer to theuser guidefor detailed instructions.Optional: When defining a workload, within the“Application” section of workload definition, you can now also specify the AWS Service Catalog AppRegistry AWS Resource Name (ARN). This field is to indicate a relationship between the AWS Well-Architected Toolworkloadand the AWS resources in an AppRegistry Application when performing a Well-Architected Framework Review (Figure 4).Figure 4. Application field to select AWS Service Catalog AppRegistry ARNThis is another new AWS Well-Architected Tool feature that launched along with the integration with Trusted Advisor feature. You can find out more details about the integration with AWS Service Catalog AppRegistry in theWhat’s New postand on thefeature documentation page. For details on how to create an AWS Service Catalog AppRegistry Application refer toCreating applications.To enable the integration with Trusted Advisor, after the necessary workload information has been entered, within the“AWS Trusted Advisor”section, tick on“Activate Trusted Advisor”(Figure 5).Figure 5. Enabling the AWS Trusted Advisor featureOptional: Once the workload is created, note the workload ARN. You can find the workload ARN in the Properties section of the workload resource you created (Figure 6). For steps on how to identify your workload, refer toWell-Architected Tool User Guide on viewing a workload.Figure 6. AWS Well-Architected Tool showing workload ARNTo collect Trusted Advisor checks from accounts other than the account where the workload you are reviewing exists, you must perform two steps. You need to ensure the account IDs are listed in the workload properties for the workload you are reviewing. You must then create an IAM role in the account from which Trusted Advisor checks will be collected with the followingpermission and trustrelationship (Figures 7 and 8). For more information on how to setup this permission, refer to thefeature documentation.Figure 7. Permissions needed by AWS Well-Architected Tool to interrogate AWS Trusted AdvisorFigure 8. The trust relationship allowing AWS Well-Architected Tool to assume policy on behalf of the workloadUsing integration with AWS Trusted Advisor for insights during reviewsOnce the feature is enabled, additional insights will be noticeable about the resources in your workload using Trusted Advisor checks. Let’s explore an example question. In this case, we will useQuestion 9 from the Reliability Pillar, as there are Trusted Advisor checks related to the best practices in it: How do you back up data?AWS Well-Architected Reliability Question 9 includes best practices that are related to how workload backup is performed to support the ability for the workload to recover from failure. Current findings using Trusted Advisor checks indicates the workload may not be configured based on the“Perform data backup automatically”best practice in the Reliability Pillar (Figure 9).Figure 9. “Perform data backup automatically” best practicesTo access Trusted Advisor checks as insights, you can select a question in the Well-Architected Tool (Figure 10). If there are related Trusted Advisor checks available for a question, there will be a“View checks”button like the screenshot below. You can also select the“Trusted Advisor checks”tab.Figure 10. AWS Trusted Advisor checks that map to best practicesTrusted Advisor checksare available, which provide insights related to thebest practicein the question. You will also notice the state of resources recommendations and the count of resources. Trusted Advisor checks that relate to the best practice “Perform data backup automatically” are displayed. One of the Trusted Advisor checks identified with axin a circle (denoting “Action recommended”) status is on theAmazon Elastic Block Storage (Amazon EBS) snapshotsavailability torecover your EBS volumefrom in the event of disaster (Figure 11).Figure 11. AWS Trusted Advisor check for Amazon EBS snapshots with “Action recommended”Exploring theTrusted Advisor Console, you can identify the EBS volume ID that has been detected with no snapshot in this us-west-2 region (Figure 12).Figure 12. An EBS volume that does not have snapshotsWith the insights from Trusted Advisor, we can quickly determine that the“Perform data backup automatically”best practice is not in place, as we do not have Amazon EBS snapshots enabled. Through the “helpful resources” section, instructions can be found to help automate the snapshot creation of Amazon EBS volume (Figure 13). One method to achieve this is to useAWS Backup.Figure 13. Resources with details about best practices, including links to learn moreUsing AWS Backup you can define a backup plan to automate snapshots creation of the EBS volume. Using this plan, you adjust the frequency of the backup to help achieve your recovery time objective and recovery point objective (Figure 14). For more information on how to configure EBS volume backup plan, refer to theDeveloper Guide on creating a backup plan.Figure 14. Setup automatic Amazon EBS volume snapshotsOnce this improvement is implemented and the related EBS volume snapshot is taken, Trusted Advisor will reflect the changes to the resource (Figure 15).Figure 15. Amazon EBS volume with a snapshotThe next time we perform a Well-Architected Framework Review on this workload, the related AWS Trusted Advisor Check will show no action required with acheck-markstatus (Figure 16).Figure 16. AWS Trusted Advisor checks that represent improvements that have been implementedOptional: For access to the list of Trusted Advisor checks in .csv format, you can click on the“Download check details”button on each question to download the resources that were checked in relation to the specified best practices (Figure 17).Figure 17. “Download check details” buttonOnce implemented, this improvement ensures a means to recover the EBS volume data in the event of disaster. This makes the resources in the workload better aligned to the AWS Reliability Pillar Design principle of “Automatically recover from failure”. To reflect this alignment in the Well-Architected Tool, you can tick on the best practice check items under the related questions (Figure 18).Figure 18. A milestone with updated best practices based on improvements that have been implementedFinally, you can create amilestoneto capture a point in time state of your workload WAFR. As you continuously optimize with more WAFRs and improvements, the number of high- and medium-risk items identified within each review will decrease. You will notice the continuous optimization of your workload over time, as in Figure 19.Figure 19. The history of improvements being made over timeConclusionUsing the AWS Well-Architected integration with AWS Trusted Advisor, customers have a mechanism to accelerate the “learn, measure, and improve” Well-Architected virtuous cycle. We have demonstrated the value of creating acceleration through the insights from Trusted Advisor checks. You now know how to enable the integration with Trusted Advisor and have seen an example of how the insights can accelerate your review cycle. You will notice the improvements you make over time will reflect in the Trusted Advisor checks as you review the milestones for your workloads. Enable this feature on your next Well-Architected Framework Review (WAFR) to measure the impact that data-driven insights from Trusted Advisor can have on reducing the time-to-value for your reviews. For more information consider these additional resources. You can contact your account team for support in running WAFRs or check out theAWS Well-Architected Partner Programtofind a partnerthat can help you run a review. Additionally, running a WAFR with a partner assisting you in remediating risks may also provide funding credits to offset the costs required to make the improvements.“Perform data backup automatically” is part of the Reliability Pillar of the AWS Well-Architected Framework. AWS Well-Architected is a set of guiding design principles developed by AWS to help organizations build secure, high-performing, resilient, and efficient infrastructure for a variety of applications and workloads. Use the AWS Well-Architected Tool to review your workloads periodically to address important design considerations and ensure that they follow the best practices and guidance of the AWS Well-Architected Framework. For follow up questions or comments, join our growing community on AWS re:Post.Stephen SalimStephen Salim is currently a Senior AWS Well-Architected GEO Solutions Architect at Amazon Web Services (AWS). He has worked at AWS since 2013 in multiple roles. As part of the AWS Well-Architected team, Stephen’s focus is to work with AWS customers and AWS Partner Network (APN) partners of all sizes to help them build secure, high-performing, resilient, and efficient infrastructure for their applications. You can follow Stephen on LinkedIn https://www.linkedin.com/in/stepsalim/.Jon SteeleJon is a Solutions Architect lead on the AWS Well-Architected team. He has worked with AWS customers to help them drive Operational Excellence in their organizations for more than 8 years at AWS in various roles. He co-authored the Operational Excellence Pillar of the Well-Architected Framework, and is constantly working to improve the guidance AWS delivers to help our customer learn, measure, and improve by "Designing with Ops in Mind".
In this blog, we will explain how the new AWS Well-Architected integration with AWS Trusted Advisor can give you insights to accelerate your cloud optimization. Customers that have the most success in their cloud adoption recognize that optimizing their cloud architecture and operations is not a one-time effort. Optimization is a continuous improvement virtuous cycle […]
Stephen Salim
Architecture AWS Trusted Advisor AWS Well-Architected Framework AWS Well-Architected Tool