AWS Security Hub · Account
Account.1: No security contact is set for AWS to reach you
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub Account.1 check?
Account.1 reads the account's alternate-contact configuration and fails whenever no Security contact is registered. AWS lets you set alternate contacts for Operations, Billing, and Security alongside the root email; this control cares specifically about the Security one.
Why does Account.1 matter?
When AWS Trust & Safety detects compromised credentials (for example an access key leaked on GitHub and scraped by their secret-scanner), they email the registered Security contact. With none on file, that notification effectively goes nowhere, adding hours or days of response latency to a live compromise. SOC 2, ISO 27001, PCI DSS, and HIPAA also expect a documented, reachable incident-response contact.
How do I fix Account.1?
- Set a Security alternate contact on the account, using a monitored distribution list rather than one person's inbox.
- Provide a phone number alongside the email address.
- Apply this across every account, ideally automated through AWS Organizations.
- Review the contact periodically so it doesn't go stale as the team changes.
Remediation script · bash
# Single-account fix — run as the account's own credentials.
aws account put-alternate-contact \
--alternate-contact-type SECURITY \
--name "Security Operations" \
--title "Security Team" \
--email-address [email protected] \
--phone-number "+1-555-0142-7700"
# Organisation-wide fix — run from the management account.
# Prerequisite: enable trusted access for the Account Management service
# (aws organizations enable-aws-service-access \
# --service-principal account.amazonaws.com), or the cross-account writes fail.
# The management account can't pass its own ID with --account-id; it must set its
# own contact in standalone context (no --account-id). Set it separately, then loop
# over the MEMBER accounts only.
mgmt_id=$(aws organizations describe-organization \
--query 'Organization.MasterAccountId' --output text)
# 1. Management account — standalone call, no --account-id.
aws account put-alternate-contact \
--alternate-contact-type SECURITY \
--name "Security Operations" \
--title "Security Team" \
--email-address [email protected] \
--phone-number "+1-555-0142-7700"
# 2. Member accounts — skip the management account ID.
for account_id in $(aws organizations list-accounts \
--query "Accounts[?Status=='ACTIVE' && Id!='$mgmt_id'].Id" --output text); do
aws account put-alternate-contact \
--account-id "$account_id" \
--alternate-contact-type SECURITY \
--name "Security Operations" \
--title "Security Team" \
--email-address [email protected] \
--phone-number "+1-555-0142-7700"
done
# Verify after rollout.
aws account get-alternate-contact --alternate-contact-type SECURITYFull walkthrough (console steps, edge cases and verification) in the lesson Set AWS account security contact information.
Is Account.1 a false positive?
A real person's individual email satisfies the check but defeats the purpose: point the Security contact at a monitored shared mailbox so a single absence doesn't mean AWS's breach notice is missed.