Control: 1 Security contact information should be provided for an AWS account

Description

This control checks if an Amazon Web Services (AWS) account has security contact information. The control fails if security contact information is not provided for the account.

Alternate security contacts allow AWS to contact another person about issues with your account in case you're unavailable. Notifications can be from AWS Support, or other AWS service teams about security-related topics associated with your AWS account usage.

Remediation

To add an alternate contact as a security contact to your AWS account, see Adding, changing, or removing alternate contacts in the AWS Billing and Cost Management User Guide.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_account_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_account_1 --share

SQL

This control uses a named query:

with alternate_security_contact as (
  select
    name,
    account_id
  from
    aws_account_alternate_contact
  where
    contact_type = 'SECURITY'
),
account as (
  select
    arn,
    partition,
    title,
    account_id,
    _ctx
  from
    aws_account
)
select
  arn as resource,
  case
    when a.partition = 'aws-us-gov' then 'info'
    -- Name is a required field if setting a security contact
    when c.name is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when a.partition = 'aws-us-gov' then a.title || ' in GovCloud, manual verification required.'
    when c.name is not null then a.title || ' has security contact ' || c.name || ' registered.'
    else a.title || ' security contact not registered.'
  end as reason
  , a.account_id
from
  account as a,
  alternate_security_contact as c
where
  c.account_id = a.account_id;

Control: 1 Security contact information should be provided for an AWS account

Description

Remediation

Usage

SQL

Tags