Skip to main content

📝 AWS VPC Transit Gateway Auto Accept Shared Attachments is enabled 🟢

  • Contextual name: 📝 Transit Gateway Auto Accept Shared Attachments is enabled 🟢
  • ID: /ce/ca/aws/vpc/disable-transit-gateway-auto-accept-shared-attachments
  • Located in: 📁 AWS VPC

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Logic​

Description​

Open File

Description​

Ensure that AWS VPC Transit Gateways are not configured to automatically accept cross-account VPC attachments. This requires that all cross-account attachment requests be manually reviewed and approved.

Rationale​

Disabling the auto-accept feature enforces administrative control over which external AWS accounts can connect their VPCs to the central transit gateway. Each request must be explicitly reviewed and approved by a network administrator, reducing the risk of unauthorized or accidental attachments from untrusted environments.

Impact​

If auto-accept is enabled, an untrusted or compromised AWS account could attach a malicious VPC to your core network. This may result in:

  • Unauthorized access to internal resources.
  • Lateral movement across your environment.
  • Data exfiltration.
  • Denial-of-service attacks against shared services.

Audit​

This policy flags an AWS VPC Transit Gateway as INCOMPLIANT if Auto Accept Shared Attachments field is set to enable.

Remediation​

Open File

Remediation​

From Command Line​

To disable automatic acceptance of cross-account VPC attachments, update the Transit Gateway options:

aws ec2 modify-transit-gateway \
    --transit-gateway-id {{transit-gateway-id}} \
    --options AutoAcceptSharedAttachments=disable

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests1
💼 Cloudaware Framework → 💼 Secure Access55
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1146
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3125
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)24
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)46
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)325
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3746
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks21
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration724