aws-account-primary-email-pii
The root-account primary email is sensitive recovery data.
Where it sits
| location | GetPrimaryEmail.PrimaryEmail |
|---|---|
| location kind | metadata |
| data kinds | pii sensitive_data |
| emits edge | ContainsSecret |
| service | Account Management (aws:account) |
Collection recipe
| access mode | read_api |
|---|---|
| operation | GetPrimaryEmail |
| response path | PrimaryEmail |
| encoding | string |
| params | {"AccountId": "\u003caccount-id-if-org-call\u003e"} |
Required permissions
account:GetPrimaryEmail