Configuring a security contact for your AWS account

Introduction

Setting up a security contact for your AWS account makes sure that critical AWS security notifications reach the right individuals in your organization for a quick response. Without a dedicated security contact, these alerts default to your root user email that your security team might not monitor. This article walks you through how to configure security contacts for different AWS account types and shares best practices for maintaining an effective security notification system.

Risks of not configuring a security contact

When you don't configure a security contact for your account, AWS sends security notifications to your account's root user email address. This is the email address that you used to create your AWS account. Although this approach works for individual users or small organizations, it presents several challenges for larger enterprises, such as the following:

• Root user email is often associated with administrative functions rather than operational security monitoring. Your security team might not monitor this email address.

• Security notifications might reach individuals who lack technical expertise to quickly assess and respond to the alert.

• For organizations that own multiple AWS accounts, AWS sends security notifications to the root email addresses for each account. This setup makes it difficult for organizations to maintain centralized visibility into security events.

Configure your security contact

Standalone accounts

If your AWS account isn’t associated with an organization, then you can update your own security contact through the AWS Management Console or AWS Command Line Interface (AWS CLI). For more information, see Update the alternate contacts for a standalone AWS account. Under Alternate contacts, locate Security contact. Then, enter the appropriate email address and other required information for your designated security contact.

Accounts in an organization

If your account is part of an organization in AWS Organizations, then you must have access to the organization's management account to update the security contact for your account. For more information, see Update the alternate contacts for any AWS account in your organization. Under Alternate contacts, locate Security contact. Then, you can add a new contact or update an existing contact.

APN Partner accounts

If you’re an AWS Partner from the AWS Partner Network (APN), then you can designate yourself as the security contact for your customer’s AWS account to improve your security management capabilities. If you do so, then you get real-time abuse notifications at the same time as your customers for faster incident response and better risk management. This approach typically reduces abuse resolution time from more than 72 hours to less than 24 hours and prevents extended issues and multiple abuse reports. As a best practice, Partners must regularly review contact information and implement clear internal processes for handling notifications. Also, make sure that you have customer consent for this security improvement.

AWS Partner accounts differ from standalone and AWS Organizations accounts. The customer account must create a cross-account role to grant the partner account permission to manage their security contact. The partner account must assume the role through the AWS CLI, AWS SDK, or the AWS Management Console to update your customer’s security contact.

Best practices to configure your security contact

When you configure a security contact, you support your notification strategy. Use the following best practices to improve the effectiveness of your security notification system:

• Create a shared inbox or distribution list that includes representatives from relevant teams that might need to collaborate during a security incident. This simple approach is particularly valuable for large organizations that manage multiple AWS accounts.

• Use a secure mail server domain for your security contact email address. This best practice is critical because you might potentially use the security contact in account recovery processes, including root user password resets.

• Implement 24/7 monitoring for the security contact email address. Security incidents can occur at any time, and rapid responses can reduce the scope and impact of a potential issue.

• Maintain current contact information. Regularly review and update your security contact details as your organization changes.

Benefits of configuring your security contact

When you add a dedicated security contact in your account, relevant notifications reach personnel who have the expertise to respond effectively. AWS sends security notifications for various scenarios that require prompt attention, such as the following:

• AWS detects violations of the AWS Acceptable Use Policy and requires a time-sensitive regulatory response.

• AWS detects unusual activity in your account, such as unexpected API calls, network traffic patterns, or data transfer patterns, that might indicate unintended access.

• AWS detects settings that aren’t consistent with security recommendations so that you can maintain compliance with security best practices.

• AWS monitors public repositories and notifies you if your AWS access keys are accidentally uploaded to public code repositories, such as GitHub. These notifications allow you to immediately rotate credentials that might have broad access.

When the right individuals receive these notifications, your organization can achieve faster incident response times, reduced potential impact from security events, and better overall security awareness across your organization.

Conclusion

If you haven't configured a security contact for your AWS account, then be sure to set it up. The process takes only a few minutes and improves your organization's security posture. For organizations with multiple AWS accounts, configure security contacts for all member accounts. This approach creates unified security monitoring and reduces missed notifications. If you need help with configuring alternate contacts, contact AWS Support.

Related information

Update the alternate security contact across your AWS accounts for timely security notifications

Securely accessing customer AWS accounts with cross-account IAM roles