Skip to main content

🛡️ AWS VPC Transit Gateway Auto Accept Shared Attachments is enabled🟢

  • Contextual name: 🛡️ Transit Gateway Auto Accept Shared Attachments is enabled🟢
  • ID: /ce/ca/aws/vpc/disable-transit-gateway-auto-accept-shared-attachments
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Description​

Open File

Description​

Ensure that AWS VPC Transit Gateways are not configured to automatically accept cross-account VPC attachments. This requires that all cross-account attachment requests be manually reviewed and approved.

Rationale​

Disabling the auto-accept feature enforces administrative control over which external AWS accounts can connect their VPCs to the central transit gateway. Each request must be explicitly reviewed and approved by a network administrator, reducing the risk of unauthorized or accidental attachments from untrusted environments.

Impact​

If auto-accept is enabled, an untrusted or compromised AWS account could attach a malicious VPC to your core network. This may result in:

  • Unauthorized access to internal resources.
  • Lateral movement across your environment.
  • Data exfiltration.
  • Denial-of-service attacks against shared services.

Audit​

This policy flags an AWS VPC Transit Gateway as INCOMPLIANT if Auto Accept Shared Attachments field is set to enable.

Remediation​

Open File

Remediation​

From Command Line​

To disable automatic acceptance of cross-account VPC attachments, update the Transit Gateway options:

aws ec2 modify-transit-gateway \
    --transit-gateway-id {{transit-gateway-id}} \
    --options AutoAcceptSharedAttachments=disable

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.23] Amazon EC2 Transit Gateways should not automatically accept VPC attachment requests1no data
💼 Cloudaware Framework → 💼 Secure Access55no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1146no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3128no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)27no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)46no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)328no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3746no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks23no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration727no data