Alternate Contacts

src/config/alternate-contacts.ts defines the security, billing, and operations contacts that are set on every AWS account in your organization. AWS uses these contacts to send service notifications relevant to each contact type, independently of the root account email.

The landing zone reads this configuration and applies the same contacts to every account in your organization during the organization phase deployment.

Options

SetAlternateContactProps has three required contact fields:

Each AlternateContact has four required fields:

Example

export const alternateContacts: SetAlternateContactProps = {
  securityContact: {
    name: 'Jane Doe',
    title: 'Security Lead',
    emailAddress: 'security@example.com',
    phoneNumber: '+1 555-0100',
  },
  billingContact: {
    name: 'John Doe',
    title: 'Finance Lead',
    emailAddress: 'billing@example.com',
    phoneNumber: '+1 555-0101',
  },
  operationsContact: {
    name: 'Jane Doe',
    title: 'Operations Lead',
    emailAddress: 'operations@example.com',
    phoneNumber: '+1 555-0102',
  },
};

How it's used

The alternate contacts are applied during the organization phase deployment and set on every account in the organization, the management account included. When you change a contact value or add an account and redeploy, the contacts are re-applied across every account automatically.

Things to know

• AWS uses the securityContact for abuse and security-advisory notifications, so make sure it reaches someone who can act on them promptly.
• Alert emails. The landing zone also emails the securityContact high and critical GuardDuty, Inspector, and Macie findings, and the operationsContact CloudWatch alarms and failed CloudFormation stack operations, through AWS User Notifications. Each address receives nothing until it is activated from the confirmation email AWS sends after the landingzone deployment that adds it. An address you change later needs activating again. See the Observability StackSet.
• AWS Health notices. The observability account receives one AWS Health notification for an event that affects several accounts. AWS doesn't email a member account's own copy to an address that is also a contact of the observability or management account, so giving every account the same alternate contacts avoids duplicates. Give root emails one base address with a + suffix, such as aws+security@, to get one copy there too. See deduplicating AWS managed notifications.
• The contacts you set here override any contacts previously configured in the AWS console for those accounts.
• The starter's values are placeholders. Replace them with real contacts before you deploy.
• Phone numbers must include the country code (e.g. +1 for US numbers).