All checks
High
EC2 Transit Gateways should not automatically accept VPC attachment requests
Checks that the transit gateway does not accept shared VPC attachment requests automatically (AutoAcceptSharedAttachments set to enable). With it on, any account the transit gateway is shared with can attach a VPC and join the network without anyone in this account approving it. The setting is read whether or not the transit gateway is shared yet.
- service
- EC2
- severity
- High
- scope
- evaluated in every region
How to fix it
- Can break clients: New attachment requests from other accounts then wait in Pending-acceptance until someone here accepts them, so automation that expects them to attach on arrival stalls.
In the console
VPC → Transit Gateways → the transit gateway → Actions → Modify transit gateway
- Auto accept shared attachments
- Cleared; attachments it already accepted stay in place
With the AWS CLI
aws ec2 modify-transit-gateway --transit-gateway-id <tgw-id> --options AutoAcceptSharedAttachments=disableWith Terraform
resource "aws_ec2_transit_gateway" "this" {
auto_accept_shared_attachments = "disable"
}See which of your accounts this check is failing on.
Book a live scan