Description

Ensure that an AWS account has a Security alternate contact configured with a valid email address and phone number, so that AWS can reach the appropriate security team directly regarding account security matters, such as reported abuse or compromised credentials.

Rationale

By default, AWS communicates account-related notices only to the account's root email address, which may not be monitored by the security team and may be a shared or infrequently checked mailbox. Configuring a dedicated Security alternate contact ensures that critical, time-sensitive security notifications from AWS (for example, notifications of exposed credentials or reported account abuse) reach the team responsible for responding, reducing the time to detect and remediate a security incident.

Impact

  • Ensures security-related AWS notifications reach the correct team promptly

  • Reduces response time to reported account abuse or credential exposure

  • Provides AWS Support and Trust & Safety teams with a reliable point of contact

Default Value

No alternate contacts (Security, Billing, or Operations) are configured by default; only the root account email receives account communications until alternate contacts are added.

Pre-Requisites

  • Root user or IAM permissions to manage account settings (account:PutAlternateContact)

  • A monitored email address and phone number for the security team

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Account menu in the top navigation and select Account.

  3. Scroll to the Alternate Contacts section.

  4. Verify that a Security contact is populated with a name, email address, phone number, and title.

  5. If using AWS Organizations, verify alternate contacts are set consistently across member accounts, either individually or via the Account Management console.

  6. If the Security contact is missing or invalid, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Account menu and select Account.

  3. Scroll to the Alternate Contacts section and select Edit.

  4. Under Security, enter the name, title, email address, and phone number of the team or individual responsible for security matters.

  5. Choose Update to save the contact.

  6. For AWS Organizations, consider using the Account Management console or the account:PutAlternateContact API to set this consistently across all member accounts.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Account menu and select Account.

  3. Scroll to the Alternate Contacts section and select Edit.

  4. Clear the Security contact fields or remove the contact.

  5. Choose Update to save the change.

Reference