Which AWS capability commonly flags security findings such as overly open security groups and other best-practice gaps?

AWS Trusted Advisor commonly flags security findings such as overly open security groups and other best-practice gaps, acting like a friendly inspector that waves a flag when something is hanging open to the world. It does not replace deeper reviews, but it surfaces issues fast for municipal teams. Amazon Polly pronunciation lexicons are for speech synthesis customization, not security posture checks. AWS Snow Family device tracking labels relate to data-transfer devices, not continuous security recommendations. Amazon Mechanical Turk task pricing concerns human task markets, not cloud security findings. Distractors fail by pointing at speech, Snow logistics, and crowdsourcing pricing instead of Trusted Advisor checks. Exam caveat: Trusted Advisor coverage can depend on support plan for some checks; treat findings as inputs to remediation ownership, not automatic fixes. Operational check: review Trusted Advisor security checks weekly, ticket open security groups and other high-risk findings, verify fixes with Config or manual review, include Trusted Advisor in monthly governance packs, and educate app teams why 0.0.0.0/0 on SSH fails best practice for city servers. In practice, export Trusted Advisor security findings into the weekly ops review, close open security groups promptly, and track recurrence so the same civic subnet does not fail the check every month.