Check ID:
Provider: AWS
Service:
Severity: MEDIUM
Resource type:
account_maintain_current_contact_detailsProvider: AWS
Service:
accountSeverity: MEDIUM
Resource type:
OtherWhat this check verifies
AWS account contact information is current for the primary contact and the alternate contacts forsecurity, billing, and operations, with accurate email addresses and phone numbers.
Risk
Outdated or single-person contacts delay security notifications, slow incident response, and complicate account recovery. AWS may throttle services during abuse mitigation, reducing availability. Missed alerts enable ongoing misuse, risking data exfiltration and unauthorized changes (integrity).Recommendation
Adopt:- Primary and alternate contacts for
security,billing,operations - Shared, monitored aliases and SMS-capable phone numbers (non-personal)
- Centralized management across accounts with periodic reviews
- Least privilege for who can modify contact data
- Regular reachability tests and documented ownership
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://repost.aws/knowledge-center/update-phone-number
- https://support.stax.io/docs/accounts/update-aws-account-contact-details
- https://maartenbruntink.nl/blog/2022/09/26/aws-account-hygiene-101-mass-updating-alternate-account-contacts/
- https://docs.aws.amazon.com/security-ir/latest/userguide/update-account-contact-info.html
- https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact-primary.html
- https://repost.aws/knowledge-center/add-update-billing-contact
- https://aws.amazon.com/blogs/security/update-the-alternate-security-contact-across-your-aws-accounts-for-timely-security-notifications/
- https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_update_contacts.html
- https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact-alternate.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = account_maintain_current_contact_details. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks