Security contact information should be provided for an AWS account
Checks that the AWS account has a security alternate contact with a name, email address and phone number, so AWS can reach someone besides the root user's email about security issues with the account. The finding names the account; in an organization, the management account can set it for a member account.
- service
- Account
- severity
- Medium
- scope
- evaluated once per account
How to fix it
In the console
Account (from the account name menu) → Alternate contacts → Security contact
- Full name
- The person or team to reach about security issues
- Title
- Their role, such as Security Operations
- Email address
- A monitored team address, such as a distribution list, rather than a person's
- Phone number
- A company number, using only digits, spaces and + - ( )
With the AWS CLI
aws account put-alternate-contact --alternate-contact-type SECURITY --name "<name>" --title "<title>" --email-address <email-address> --phone-number "<phone-number>"With Terraform
resource "aws_account_alternate_contact" "security" {
alternate_contact_type = "SECURITY"
name = var.security_contact_name
title = var.security_contact_title
email_address = var.security_contact_email
phone_number = var.security_contact_phone
}
See which of your accounts this check is failing on.
Book a live scan