Determining an AWS Root Account Email Address

Every AWS account is anchored to a root user identified by an email address. That address is a high-value reconnaissance target: it is the account’s ultimate credential recovery point, the recipient of security notifications, and a candidate for phishing or password-reset attacks. AWS does not expose the root email through any general-purpose API, but several services leak it — or fragments of it — to callers who already hold some level of access to the account.

There is no single reliable method; the techniques below are ordered roughly from “clue” to “authoritative”.

Account alias (user-part hint)

An IAM account alias is a human-friendly name used in the IAM sign-in URL. Administrators frequently set the alias to the same string as the local part of the root email (acme-corp@…). Listing aliases requires only the iam:ListAccountAliases permission, commonly granted to read-only roles:

aws iam list-account-aliases

The alias is at best a guess at the email’s user part, but it narrows a brute-force or OSINT search substantially.

AWS Support case history

If the root user (or anyone) ever opened a support case, the case metadata records who submitted it:

aws support describe-cases \
    --region $AWS_REGION \
    --include-resolved-cases \
    --query "cases[0].submittedBy"

Support API access requires a Business/Enterprise support plan, so this fails on free-tier accounts — but when it works, submittedBy often contains the raw email address.

SNS subscriptions

If the root address was subscribed to any SNS topic (a common pattern for billing and CloudWatch alarms), it appears in the subscription list:

aws sns list-subscriptions

Endpoints of protocol email or email-json reveal full addresses unless the subscription is still pending confirmation.

AWS Organizations (authoritative)

When the account is a member of an AWS Organization and the caller’s credentials have organizations:DescribeAccount, the organization API returns the account’s registered email directly:

aws organizations describe-account \
    --account-id $(aws sts get-caller-identity --query Account --output text) \
    --query Account.Email

Likewise, aws organizations list-accounts returns an Email field for every account in the organization. This is the only method that yields the actual root email with certainty — every AWS account’s root identity is the email supplied at account creation, which Organizations records.

S3 bucket ACLs (legacy display names)

Historically, S3 bucket ACLs identified grantees by a canonical display name derived from the account’s original signup identity. If the root user created buckets, enumerating them with boto3 can disclose the display name (often the email local part):

#!/usr/bin/env python3
import boto3
 
s3 = boto3.client('s3')
print(s3.list_buckets()['Owner']['DisplayName'])
for bucket in s3.list_buckets()['Buckets']:
    print(s3.get_bucket_acl(Bucket=bucket['Name'])['Owner']['DisplayName'])

Note: display names were deprecated as ACL grantee identifiers in favor of canonical user IDs, so this works mainly on older accounts.

Defensive considerations

• Treat the account alias as sensitive — don’t mirror the root email in it.
• Audit SNS topics and old support cases for exposed addresses.
• In Organizations, restrict organizations:Describe* to roles that need it; the management account can see every member’s email.
• These techniques require some valid AWS credentials for the account (or the organization), so the primary defense is standard credential hygiene — see aws-ssm-ssh and aws-ecs-exec for how temporary, role-based access reduces long-lived credential exposure.

Sources

• Get AWS root account email address (andresriancho Gist)
• AWS CLI: list-account-aliases
• AWS CLI: describe-account
• AWS CLI: list-accounts
• AWS CLI: describe-cases

See also

• confirm-gmail-address-existence — adjacent technique for validating guessed email addresses
• aws-sigv4-api-flooding — abusing the same SigV4-authenticated API surface
• ec2-instance-metadata-imds — another AWS information-disclosure surface (credentials rather than identity)