Security contact information is not registered

Description

Ensure that the contact email and telephone information for AWS accounts are accurate and linked to multiple designated individuals within your organization. AWS accounts support a variety of contact details, which AWS utilizes to notify the account owner in the event of activities that breach the Acceptable Use Policy or suggest a potential security incident, as identified by the AWS Abuse team. Contact information should not be restricted to a single individual, as availability issues may arise. Email contact details should be configured to route to a mail alias, which forwards messages to multiple personnel within the organization.

In cases where an AWS account demonstrates suspicious or prohibited behavior, AWS will attempt to contact the account owner via the provided email and telephone details. If these attempts are unsuccessful and urgent intervention is required, AWS may initiate preventive actions, including traffic throttling between the compromised account and AWS API endpoints or the wider Internet, potentially leading to service degradation.

To ensure rapid response, it is recommended to configure AWS account contact details to direct notifications to resources with multiple recipients, such as email aliases, PABX hunt groups, or other call forwarding mechanisms.

Fix - Buildtime

AWS Console​

To establish security contact information, follow these steps:

  1. Log in to the AWS Management Console at https://console.aws.amazon.com/.
  2. On the navigation bar select your account name, then select My Account.
  3. Scroll down to the Alternate Contacts section.
  4. Enter contact information in the Security section.
ReLambda