No security alternate contact registered for the AWS account

Severity: Medium
Service: IAM
Check ID: SECURITY_CONTACT_NOT_SET

What this check finds

AWS allows designating a security alternate contact who is notified when AWS detects suspicious activity or compliance events. Without one, alerts go only to the root email address, which may not reach the security team promptly.

Passing looks like: Account security contact registered.

How to fix it

Set a security alternate contact.

AWS CLI

aws account put-alternate-contact --alternate-contact-type SECURITY --name "Security Team" --email security@example.com --phone-number "+1-555-555-5555" --title "Security Contact"

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

AWS account menu (top-right) → Account → Alternate contacts → Security → Edit.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to No security alternate contact registered for the AWS account
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.2 Ensure security contact information is registered
NIST SP 800-53 Rev5 (Moderate)	IR-6 Incident Reporting
NIST Cybersecurity Framework 2.0	RS.CO-02 Incidents are reported to stakeholders
ISO/IEC 27001:2022 Annex A	A.6.8 Information security event reporting

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks