AWS account contact details should be kept current
This check looks at the primary contact details registered on the AWS account, such as the contact name, address and phone number. The safe setting is that these details are accurate and monitored, so AWS can reach a real person about account or security issues.
Why it matters
AWS sends notices about billing, abuse reports and security events to the contacts stored on the account. If that information is out of date, or points to one person who left the company, a warning can go unseen until after damage is done.
AWS describes where the details are kept and how to change them in Update the primary contact for your AWS account. Keeping them current takes minutes and removes a common blind spot during an incident.
How to check it yourself
Sign in to the AWS Management Console as the account owner or an administrator with account permissions, open the account menu in the top right and choose Account. Review Contact information and check the name, company, address, phone number and website are right and that the phone and mailbox are attended.
Read-only command:
aws account get-contact-informationFor an account in an organization, add --account-id <member-account-id> when run from the management account. Check each member account, because each has its own contact record.
How to fix it
Portal steps:
- Open Account from the account menu.
- Next to Contact information choose Edit.
- Enter a role-based contact, such as a shared team phone line, rather than one person's mobile, and save.
Script (changes your AWS account when run; ConfigCobra never changes it):
aws account put-contact-information --contact-information \
FullName="<team name>",CompanyName="<company>",AddressLine1="<street>",City="<city>",PostalCode="<code>",CountryCode=<XX>,PhoneNumber="<+number>"Put the review in your regular calendar so the details are checked when staff or offices change.
What changes when you fix it
Nothing in your workloads is affected: no resource restarts and no permission changes. The people affected are whoever receives AWS notices; make sure the named team agrees to watch the phone and mailbox, and that a shared mailbox rather than an individual's address is used where possible.
Before you save, confirm the address is one the company will keep for years and not a temporary office, and check that the phone number can receive calls from abroad, since AWS may ring it during an urgent case. Billing and legal teams may also use the same contact, so tell them about the change. The update needs permission to the account settings, which is normally held by the account owner or a small administrator group. In an organization, agree who owns the records for member accounts so they are not forgotten when accounts are created later.
Included in
| Benchmark | CIS ID | Profile |
|---|---|---|
| CIS Amazon Web Services Foundations v7.0.0 | 2.2 | Level 1 |
Check this on your AWS
ConfigCobra runs this check with every other control of the CIS Amazon Web Services Benchmarks, read-only.