c1.1 Assign account security contacts

Let AWS reach you about a security issue

Set the alternate security contact on every account and monitor that mailbox. AWS uses it to alert you about abuse or potential security incidents it detects in your infrastructure — for example if one of your access keys is exposed in a public code repository.

Point the contact at a distribution list of two or three people, not a single person, so an alert is still seen when someone is on vacation. Avoid ex-employee addresses — stale contacts are a silent failure.

Manage contacts centrally with AWS Organizations

You can set and update the alternate contacts (security, billing, operations) for every member account centrally from the management account with AWS Organizations, instead of signing in to each account — and automate it with the Accounts API.

Protect the recovery path

The contact email can be used to reset the root password via "Forgot my password", so use a secure mail domain and restrict who controls it. Configuring root MFA also strengthens the lost-or-broken MFA recovery path.

Set the security contact with the CLI

Set the alternate security contact on an account (run from the account, or pass --account-id from the management account):

aws account put-alternate-contact \
  --alternate-contact-type SECURITY \
  --name "Security distribution list" \
  --email-address security-alerts@example.com \
  --phone-number "+1-555-0100" \
  --title "Security Team"