Back to Checks
aws

AWS account has distinct Security, Billing, and Operations contact details, different from each other and from the root contact

account_maintain_different_contact_details_to_security_billing_and_operations
Service: accountSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

AWS account alternate contacts are defined for Security, Billing, and Operations with name, email, and phone. The finding evaluates that all three exist, are distinct from one another, and differ from the primary (root) contact.

Prowler logoProwlerprowler-provider-aws

Risk

Missing or shared contacts can delay response to abuse alerts, credential compromise, or billing anomalies, reducing availability (possible AWS traffic throttling) and raising confidentiality and integrity risk through extended exposure. If AWS cannot reach you, urgent mitigation may disrupt service.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks account_maintain_different_contact_details_to_security_billing_and_operations

Recommendation

Maintain distinct, monitored Security, Billing, and Operations alternate contacts that differ from the root contact.

  • Use team aliases and 24x7 phones
  • Review and test contact paths regularly
  • Centralize at org level for consistency

Applies operational resilience and separation of duties.

Remediation

Terraform

# Set distinct alternate contacts for SECURITY, BILLING, and OPERATIONS
# Critical: each resource sets a required contact type to satisfy the check

resource "aws_account_alternate_contact" "security" {
  alternate_contact_type = "SECURITY"  # Sets SECURITY contact
  email_address          = "security@example.com"
  name                   = "Security Team"
  phone_number           = "+1-555-0100"
  title                  = "Security"
}

resource "aws_account_alternate_contact" "billing" {
  alternate_contact_type = "BILLING"   # Sets BILLING contact
  email_address          = "billing@example.com"
  name                   = "Billing Team"
  phone_number           = "+1-555-0101"
  title                  = "Billing"
}

resource "aws_account_alternate_contact" "operations" {
  alternate_contact_type = "OPERATIONS" # Sets OPERATIONS contact
  email_address          = "operations@example.com"
  name                   = "Operations Team"
  phone_number           = "+1-555-0102"
  title                  = "Operations"
}

Other

1Sign in to the AWS Management Console with a user that can edit account contacts (root, or IAM with account:PutAlternateContact)
2In the upper right, click your account name > Account
3Scroll to "Alternate contacts" and click Edit
4Add all three contacts with unique details:
5- Billing contact (distinct name, email, phone)
6- Operations contact (distinct name, email, phone)
7- Security contact (distinct name, email, phone)
8Ensure each contact’s email/phone differs from each other and from the primary (root) contact, then click Update

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.account.account_client import account_client


class account_maintain_different_contact_details_to_security_billing_and_operations(
    Check
):
    def execute(self):
        findings = []
        if account_client.contact_base:
            report = Check_Report_AWS(metadata=self.metadata(), resource={})
            report.resource_id = account_client.audited_account
            report.resource_arn = account_client.audited_account_arn
            report.region = account_client.region

            if (
                len(account_client.contact_phone_numbers)
                == account_client.number_of_contacts
                and len(account_client.contact_names)
                == account_client.number_of_contacts
                # This is because the primary contact has no email field
                and len(account_client.contact_emails)
                == account_client.number_of_contacts - 1
            ):
                report.status = "PASS"
                report.status_extended = "SECURITY, BILLING and OPERATIONS contacts found and they are different between each other and between ROOT contact."
            else:
                report.status = "FAIL"
                report.status_extended = "SECURITY, BILLING and OPERATIONS contacts not found or they are not different between each other and between ROOT contact."
            findings.append(report)
        return findings

References