Back to Checks
aws

AWS account has security alternate contact registered

account_security_contact_information_is_registered
Service: accountSeverity: medium
OfficialBuilt-inVerified
Resource Type:Other

Account settings contain a Security alternate contact in Alternate Contacts (name, EmailAddress, PhoneNumber) for targeted AWS security notifications.

Prowler logoProwlerprowler-provider-aws

Risk

Missing or outdated security contact can delay or prevent AWS advisories from reaching responders, increasing risk to:

  • Confidentiality: data exfiltration from undetected compromise
  • Integrity: unauthorized changes persist longer
  • Availability: resource abuse (e.g., cryptomining) and outages

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks account_security_contact_information_is_registered

Recommendation

Define and maintain a Security alternate contact:

  • Use a monitored alias (e.g., security@domain) and team phone
  • Apply to every account (prefer Org-wide automation)
  • Review after org/personnel changes and test delivery
  • Document ownership and escalation paths Align with incident response and least privilege principles.

Remediation

CLI

aws account put-alternate-contact --alternate-contact-type SECURITY --email-address <EMAIL_ADDRESS> --name <CONTACT_NAME> --phone-number <PHONE_NUMBER>

Terraform

# Set the SECURITY alternate contact for the current AWS account
resource "aws_account_alternate_contact" "<example_resource_name>" {
  alternate_contact_type = "SECURITY"  # Critical: sets Security contact type
  email_address          = "security@example.com"  # Contact email
  name                   = "Security Team"         # Contact name
  phone_number           = "+1-555-0100"          # Contact phone
}

Other

1Sign in to the AWS Management Console as the root user or an admin with account:PutAlternateContact
2Click your account name (top-right) and select My Account (or Account)
3Scroll to Alternate Contacts and click Edit in the Security section
4Enter Security Email, Name, and Phone Number
5Click Update (or Save changes)

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.account.account_client import account_client

# This check has no findings since it is manual


class account_security_contact_information_is_registered(Check):
    def execute(self):
        report = Check_Report_AWS(metadata=self.metadata(), resource={})
        report.region = account_client.region
        report.resource_id = account_client.audited_account
        report.resource_arn = account_client.audited_account_arn
        report.status = "MANUAL"
        report.status_extended = "Login to the AWS Console. Choose your account name on the top right of the window -> My Account -> Alternate Contacts -> Security Section."
        return [report]

References