Control: 1.2 Ensure security contact information is registered

Description

AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.

Specifying security-specific contact information will help ensure that security advisories sent by AWS reach the team in your organization that is best equipped to respond to them.

Remediation

Perform the following to establish security contact information:

From Console

Click on your account name at the top right corner of the console.
From the drop-down menu Click My Account.
Scroll down to the Alternate Contacts section.
Enter contact information in the Security section.

From Command Line

Run the following command with the following input parameters: --email-address, --name, and --phone-number.

aws account put-alternate-contact --alternate-contact-type SECURITY

Note: Consider specifying an internal email distribution list to ensure emails are regularly monitored by more than one individual.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_v400_1_2

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_v400_1_2 --share

SQL

This control uses a named query:

with alternate_security_contact as (
  select
    name,
    account_id
  from
    aws_account_alternate_contact
  where
    contact_type = 'SECURITY'
),
account as (
  select
    arn,
    partition,
    title,
    account_id,
    _ctx
  from
    aws_account
)
select
  arn as resource,
  case
    when a.partition = 'aws-us-gov' then 'info'
    -- Name is a required field if setting a security contact
    when c.name is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when a.partition = 'aws-us-gov' then a.title || ' in GovCloud, manual verification required.'
    when c.name is not null then a.title || ' has security contact ' || c.name || ' registered.'
    else a.title || ' security contact not registered.'
  end as reason
  , a.account_id
from
  account as a
  left join alternate_security_contact as c on  c.account_id = a.account_id;