AWS account has security alternate contact registered

Check ID: account_security_contact_information_is_registered
Provider: AWS
Service: account
Severity: MEDIUM
Resource type: Other

What this check verifies

Account settings contain a Security alternate contact in Alternate Contacts (name, EmailAddress, PhoneNumber) for targeted AWS security notifications.

Risk

Missing or outdated security contact can delay or prevent AWS advisories from reaching responders, increasing risk to:

Confidentiality: data exfiltration from undetected compromise
Integrity: unauthorized changes persist longer
Availability: resource abuse (e.g., cryptomining) and outages

Recommendation

Define and maintain a Security alternate contact:

Use a monitored alias (e.g., security@domain) and team phone
Apply to every account (prefer Org-wide automation)
Review after org/personnel changes and test delivery
Document ownership and escalation paths Align with incident response and least privilege principles.

Remediation

CLI
Terraform
Dashboard steps

aws account put-alternate-contact —alternate-contact-type SECURITY —email-address <EMAIL_ADDRESS> —name <CONTACT_NAME> —phone-number <PHONE_NUMBER>

# Set the SECURITY alternate contact for the current AWS account
resource "aws_account_alternate_contact" "<example_resource_name>" {
  alternate_contact_type = "SECURITY"  # Critical: sets Security contact type
  email_address          = "[email protected]"  # Contact email
  name                   = "Security Team"         # Contact name
  phone_number           = "+1-555-0100"          # Contact phone
}

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = account_security_contact_information_is_registered. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Security, Billing, and Operations contacts are distinct [DEPRECATED] AWS root user has security questions set

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires