Check ID: account_maintain_different_contact_details_to_security_billing_and_operations
Provider: AWS
Service: account
Severity: MEDIUM
Categories: resilience
Resource type: Other

​
What this check verifies

AWS account alternate contacts are defined for Security, Billing, and Operations with name, email, and phone. The finding evaluates that all three exist, are distinct from one another, and differ from the primary (root) contact.

​
Risk

Missing or shared contacts can delay response to abuse alerts, credential compromise, or billing anomalies, reducing availability (possible AWS traffic throttling) and raising confidentiality and integrity risk through extended exposure. If AWS cannot reach you, urgent mitigation may disrupt service.

​
Recommendation

Maintain distinct, monitored Security, Billing, and Operations alternate contacts that differ from the root contact.
  • Use team aliases and 24x7 phones
  • Review and test contact paths regularly
  • Centralize at org level for consistency
Applies operational resilience and separation of duties.

​
Remediation

# Set distinct alternate contacts for SECURITY, BILLING, and OPERATIONS
# Critical: each resource sets a required contact type to satisfy the check

resource "aws_account_alternate_contact" "security" {
  alternate_contact_type = "SECURITY"  # Sets SECURITY contact
  email_address          = "[email protected]"
  name                   = "Security Team"
  phone_number           = "+1-555-0100"
  title                  = "Security"
}

resource "aws_account_alternate_contact" "billing" {
  alternate_contact_type = "BILLING"   # Sets BILLING contact
  email_address          = "[email protected]"
  name                   = "Billing Team"
  phone_number           = "+1-555-0101"
  title                  = "Billing"
}

resource "aws_account_alternate_contact" "operations" {
  alternate_contact_type = "OPERATIONS" # Sets OPERATIONS contact
  email_address          = "[email protected]"
  name                   = "Operations Team"
  phone_number           = "+1-555-0102"
  title                  = "Operations"
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = account_maintain_different_contact_details_to_security_billing_and_operations. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks