Back to Checks
gcp

Organization has Essential Contacts configured

iam_organization_essential_contacts_configured
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:cloudresourcemanager.googleapis.com/Organization

Google Cloud organization has Essential Contacts defined at the organization level for categories such as SECURITY, BILLING, LEGAL, SUSPENSION, TECHNICAL, or PRODUCT_UPDATES.

Evaluates whether at least one contact is configured.

Prowler logoProwlerprowler-provider-gcp

Risk

Missing Essential Contacts means security, abuse, and billing notices can go unnoticed or to inappropriate recipients, slowing response.

Consequences: data exposure via unaddressed alerts (C), unauthorized changes persisting (I), and suspensions/outages from unresolved issues (A).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks iam_organization_essential_contacts_configured

Recommendation

Configure Essential Contacts at the organization (and inherit to folders/projects) with group aliases for SECURITY, BILLING, LEGAL, SUSPENSION, TECHNICAL, and PRODUCT_UPDATES.

Apply least privilege and separation of duties. Review quarterly, verify delivery, and restrict contacts to approved domains.

Remediation

CLI

gcloud essential-contacts create --email=<EMAIL> --notification-categories=all --organization=<ORGANIZATION_ID>

Terraform

resource "google_essential_contacts_contact" "<example_resource_name>" {
  parent = "organizations/<example_resource_id>"            # Critical: set at org level to satisfy the check
  email  = "<EMAIL>"                                        # Critical: creates the essential contact
  notification_category_subscriptions = ["ALL"]             # Critical: required; ensures the contact is created
}

Other

1In the Google Cloud console, go to Essential Contacts
2In the resource selector, choose your Organization
3Click Add contact
4Enter the contact email and select category All
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.iam.essentialcontacts_client import (
    essentialcontacts_client,
)


class iam_organization_essential_contacts_configured(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for org in essentialcontacts_client.organizations:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=org,
                project_id=essentialcontacts_client.default_project_id,
                location=essentialcontacts_client.region,
            )
            report.status = "FAIL"
            report.status_extended = (
                f"Organization {org.name} does not have essential contacts configured."
            )
            if org.contacts:
                report.status = "PASS"
                report.status_extended = (
                    f"Organization {org.name} has essential contacts configured."
                )
            findings.append(report)

        return findings

References