Your AWS account should have a security contact registered

AWS sends notices about suspected abuse, compromised credentials and security-related account activity to the contacts on the account. If no security contact is set, those messages go only to the primary contact, which is often a person who has left, a finance mailbox or an address nobody reads. A registered security contact means the people who can actually act on a warning receive it. AWS describes alternate contacts, including the security type, in its account management documentation.

Sources: AWS Account Management: update alternate contacts.

In the console, choose your account name at the top right, open Account and scroll to Alternate contacts. The Security section should show a name, email address and phone number that belong to your security team.

From the AWS CLI, this read-only call returns the security contact, or an error saying none exists:

aws account get-alternate-contact --alternate-contact-type SECURITY

If you manage several accounts through AWS Organizations, add --account-id with a member account ID from the management account and repeat per account. Run it from a test profile first so you know which account you are looking at.

In the console: Account → Alternate contacts → Edit next to Security, then enter a name, title, email address and phone number and save. Use a shared team mailbox rather than a personal one, so the contact survives staff changes.

With the AWS CLI, run this with an identity that is allowed to change account contacts. It is a change to the account, so review the values first:

aws account put-alternate-contact \
  --alternate-contact-type SECURITY \
  --name "Security Team" \
  --title "Security" \
  --email-address security-team@example.com \
  --phone-number "+10000000000"

ConfigCobra itself never changes your account. It reports the finding and generates the script or portal steps for you to run.

Nothing is switched off and no workload is touched. The only effect is that security notices from AWS start arriving at the new address. Tell the mailbox owners what to expect and who should triage the messages, otherwise the contact exists but nobody reacts. Use a role-based mailbox that is also monitored outside office hours if your team covers incidents around the clock. The change applies per account, so member accounts need their own contact unless you set it centrally from the organization's management account.