How to Schedule Automatic AWS Trusted Advisor Check Refreshes Using EventBridge Scheduler

This article shows how to set up automated, scheduled refreshes of AWS Trusted Advisor checks using Amazon EventBridge Scheduler and AWS Lambda, ensuring your findings stay current without manual intervention.

Introduction

AWS Trusted Advisor checks refresh on different schedules depending on the check type. Some refresh automatically every few hours, while others only refresh when you manually trigger them from the console or API. If you rely on stale check results, you might miss new security gaps or cost optimization opportunities.

By combining Amazon EventBridge Scheduler with a simple Lambda function, you can refresh all your Trusted Advisor checks on a predictable schedule (for example, daily at 6 AM). This ensures your findings are always current when your team reviews them, and it pairs perfectly with EventBridge rules that react to check status changes.

Architecture

EventBridge Scheduler (daily at 06:00 UTC)
    → Lambda function
        → Calls RefreshTrustedAdvisorCheck for each check ID
        → Respects millisUntilNextRefreshable rate limit

Prerequisites

• Business Support+ or Enterprise Support plan
• Lambda and EventBridge Scheduler deployed in us-east-1 (required for Trusted Advisor API)

Step 1: Get your check IDs

First, list all available checks to get their IDs:

aws support describe-trusted-advisor-checks \
  --language en \
  --region us-east-1 \
  --query 'checks[].{id:id, name:name, category:category}' \
  --output table

This returns all checks with their IDs, names, and categories. Save the check IDs you want to refresh. To refresh all checks, collect all IDs.

Step 2: Create the Lambda function

1. Open the Lambda console in us-east-1.
2. Create a function named TA-ScheduledRefresh with Python 3.12.
3. Set timeout to 5 minutes (refreshing many checks takes time due to rate limiting).
4. Attach a role with this policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "support:RefreshTrustedAdvisorCheck",
        "support:DescribeTrustedAdvisorChecks"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:us-east-1:ACCOUNT_ID:*"
    }
  ]
}

5. Paste the following code:

import boto3
import time

support = boto3.client('support', region_name='us-east-1')


def lambda_handler(event, context):
    """
    Refreshes all eligible Trusted Advisor checks.
    Respects rate limits using millisUntilNextRefreshable.
    """
    # Get all available checks
    response = support.describe_trusted_advisor_checks(language='en')
    checks = response['checks']

    refreshed = 0
    skipped = 0
    errors = 0

    for check in checks:
        check_id = check['id']
        check_name = check['name']

        try:
            result = support.refresh_trusted_advisor_check(checkId=check_id)
            status = result['status']['status']

            if status == 'enqueued' or status == 'processing':
                refreshed += 1
            else:
                skipped += 1

            # Respect rate limit: wait if needed
            wait_ms = result['status'].get('millisUntilNextRefreshable', 0)
            if wait_ms > 0:
                time.sleep(wait_ms / 1000.0)

        except support.exceptions.InvalidParameterValueException:
            # This check refreshes automatically and can't be manually refreshed
            skipped += 1
        except Exception as e:
            print(f"Error refreshing {check_name} ({check_id}): {str(e)}")
            errors += 1

    summary = f"Refresh complete: {refreshed} refreshed, {skipped} skipped (auto-refresh), {errors} errors"
    print(summary)
    return {'statusCode': 200, 'body': summary}

6. Choose Deploy.

Step 3: Create the EventBridge schedule

1. Open the Amazon EventBridge console in us-east-1.
2. In the navigation pane, choose Schedules (under Scheduler).
3. Choose Create schedule.
4. Name: TA-DailyRefresh
5. For Schedule pattern, choose Recurring schedule.
6. Select Cron-based schedule and enter: cron(0 6 * * ? *) (daily at 06:00 UTC).
7. Choose Next.
8. For Target, choose AWS Lambda and select your TA-ScheduledRefresh function.
9. Complete the wizard and choose Create schedule.

Step 4: Verify

After the first scheduled run:

1. Check CloudWatch Logs for the Lambda function.
2. Look for the summary line: "Refresh complete: X refreshed, Y skipped, 0 errors"
3. Open the Trusted Advisor console and confirm checks show a recent "Last refreshed" timestamp.

Customizing the refresh scope

To refresh only specific categories (for example, security checks only), modify the Lambda to filter by category:

# Only refresh security checks
# Run describe-trusted-advisor-checks first to see exact category values
security_checks = [c for c in checks if c['category'] == 'security']
for check in security_checks:
    # ... same refresh logic

To see your available category values, run:

aws support describe-trusted-advisor-checks \
  --language en \
  --region us-east-1 \
  --query 'checks[].category' \
  --output text | tr '\t' '\n' | sort -u

Choosing a refresh frequency

Frequency	Use case
Every 6 hours	High-security environments needing near-real-time findings
Daily (recommended)	General best practice for most accounts
Weekly	Low-change environments with stable infrastructure

Important: Some checks have a minimum refresh interval (indicated by millisUntilNextRefreshable in the API response). The Lambda function above respects this automatically. Refreshing more frequently than allowed will not produce updated results.

Connecting to your automation pipeline

Scheduled refreshes work best when paired with automated remediation:

1. This article: Ensures checks are refreshed on a predictable schedule
2. Automate Trusted Advisor Remediation with EventBridge and Lambda: Reacts to findings the moment they appear after a refresh
3. Prioritize Findings Using a Risk and Effort Matrix: Determines which findings to fix first

Together, these three create a complete loop: refresh → detect → prioritize → remediate.

Important notes

• The Trusted Advisor API must be called from us-east-1 only.
• Some checks refresh automatically and will return InvalidParameterValueException when you try to refresh them manually. The Lambda code above handles this gracefully.
• Requires Business Support+ or Enterprise Support plan.
• The millisUntilNextRefreshable field tells you the minimum wait time before a check can be refreshed again. The Lambda respects this to avoid wasted API calls.

Related information

• RefreshTrustedAdvisorCheck API reference
• DescribeTrustedAdvisorChecks API reference
• Amazon EventBridge Scheduler
• Automate Trusted Advisor Remediation with EventBridge and Lambda
• Prioritize Trusted Advisor Findings Using a Risk and Effort Matrix