AWS Account Root User Email and Alternate Contacts Security

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

D Configure root user email aliases to a centralized mailbox and set alternate contacts using separate distribution lists for billing, operations, and security teams.

Question

A company creates dedicated AWS accounts in AWS Organizations for its business units. Recently, an important notification was sent to the root user email address of a business unit account instead of the assigned account owner. The company wants to ensure that all future notifications can be sent to different employees based on the notification categories of billing, operations, or security. Which solution will meet these requirements MOST securely?
  1. Configure each AWS account to use a single email address that the company manages. Ensure that all account owners can access the email account to receive notifications. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
  2. Configure each AWS account to use a different email distribution list for each business unit that the company manages. Configure each distribution list with administrator email addresses that can respond to alerts. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
  3. Configure each AWS account root user email address to be the individual company managed email address of one person from each business unit. Configure alternate contacts for each AWS account with corresponding distribution lists for the billing team, the security team, and the operations team for each business unit.
  4. Configure each AWS account root user to use email aliases that go to a centralized mailbox. Configure alternate contacts for each account by using a single business managed email distribution list each for the billing team, the security team, and the operations team. Correct Answer

Key Takeaways

The exam tests the distinction between direct individual access versus centralized aliasing for root users, combined with role-specific distribution lists for alternate contacts to ensure segregation of duties.

This question tests the secure management of AWS account notifications by configuring root user email aliases and dedicated alternate contact distribution lists for billing, operations, and security.

Common mistake: Many candidates choose Option A because they focus on shared ownership but fail to recognize that using a single generic address without aliasing or specific team routing is less secure and harder to manage than centralized aliases with distinct distribution lists.

Expert Analysis

Why the Answer Is Correct

Option D is the most secure solution because it addresses two critical aspects: root user notification security and operational segregation. By configuring the root user email to use an alias pointing to a centralized mailbox, the company prevents sensitive root-level notifications from going directly to an individual's personal inbox, reducing the risk of compromise if that individual leaves or their credentials are breached. Furthermore, configuring alternate contacts (Billing, Operations, Security) with separate, business-managed distribution lists ensures that each team receives only relevant notifications, maintaining a clear audit trail and preventing information leakage between departments.

Why the Other Options Are Wrong

Option A suggests using a single email address accessible by all account owners; this lacks segregation of duties and creates a shared secret problem where anyone can see all notifications. Option B configures the root user with different distribution lists, which is good, but fails to explicitly mention centralizing the root user email in a way that mitigates individual compromise risks as effectively as an alias, and often implies multiple lists rather than a unified secure entry point. Option C directs root emails to individual employees, which is the exact vulnerability the question seeks to fix, as those individuals may leave or be compromised.

Community Comment Notes

Community consensus strongly favors Option D, with many users highlighting that email aliases provide a layer of abstraction for root notifications. Several comments reference AWS documentation confirming that alternate contacts should be set up per team (billing, security, operations) to ensure proper routing. One commenter noted that while Option B uses distribution lists, Option D's approach to the root user via aliases is superior for security hygiene. Another user pointed out that Option A's 'single email address' model does not offer the same level of control and security as dedicated distribution lists for specific functions.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always look for solutions that separate responsibilities (segregation of duties). When dealing with root user access or notifications, prefer centralized, abstracted mechanisms like aliases or shared mailboxes over direct individual assignments to reduce risk associated with personnel changes.

Frequently Asked Questions

Why is an email alias better than a distribution list for the root user?

An alias allows you to hide the actual destination and change the backend recipient without changing the public-facing email address, providing flexibility and security against personnel turnover.

Can I use one distribution list for all alternate contacts?

No, best practice dictates separate distribution lists for Billing, Operations, and Security to ensure segregation of duties and prevent unauthorized access to sensitive data across teams.

More SAA-C03 FAQ →

Community Votes

D
70%
A
30%

70% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. Linuslin 👍 11 Answered D
    D is correct answer. Configuring each AWS account's root user to use email aliases that go to a centralized mailbox ensures that sensitive notifications are not directly sent to individual email addresses. Instead, they are directed to a centralized mailbox, reducing the risk of unauthorized access to sensitive information. Additionally, configuring alternate contacts for each account using a single business-managed email distribution list for the billing team, the security team, and the operations team ensures that notifications are appropriately routed to the respective teams based on the categories of billing, operations, or security. This approach centralizes control and reduces the likelihood of misconfiguration or unauthorized access to sensitive notifications.
  2. d401c0d 👍 5 Answered A
    Question mentions the email was sent to a business unit account instead of an account owner. Thus, A mentions all account owners to have access to email account.
  3. sheilawu 👍 4 Answered A
    https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_update_primary_email.html
  4. MatAlves 👍 3 Answered D
    Both B and D use Distribution Lists as part of the of the solution: B - "configure each DL with administrator email addresses that can respond to alerts" D - "configure alternate contacts for each account by using single business managed DL each" per team. I confess the wording isn't amazing, but between B and D, the latter is the one that properly addresses the issue involving root user email address.
  5. bujuman 👍 3 Answered D
    The most secure way should use "Update the alternate contacts for any AWS account in your organization" https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact-alternate.html
Show 3 more comments
  1. GOTJ 👍 1 Answered B
    Option B is correct, according to AWS Prescriptive Guidance (see link below): When setting up primary and alternate contacts for your AWS account, use an email distribution list instead of an individual’s email address. Using an email distribution list makes sure that ownership and reachability are preserved as individuals in your organization come and go. Set alternate contacts for billing, operations, and security notifications, and use appropriate email distribution lists accordingly. AWS uses these email addresses to contact you, so it is important you retain access to them. https://docs.aws.amazon.com/prescriptive-guidance/latest/aws-startup-security-baseline/acct-01.html
  2. MrIndia2022 👍 1
    question- option D uses a single distribution list for all business units vs Option B which uses separate, independent distribution lists for each business unit. This involves more segregation of emails and hence is more secure. I am confused between option B and d. Pl help
  3. jadeconstancy 👍 4 Answered D
    correct answer is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide