Transit Gateway does not auto-accept VPC attachments

Check ID: ec2_transitgateway_auto_accept_vpc_attachments
Provider: AWS
Service: ec2
Severity: HIGH
Categories: trust-boundaries
Resource type: AwsEc2TransitGateway

What this check verifies

EC2 Transit Gateways with AutoAcceptSharedAttachments=enable automatically approve cross-account VPC attachments. The evaluation identifies transit gateways configured to auto-accept shared attachments.

Risk

Auto-accepting cross-account attachments can link untrusted VPCs to your routing domain, impacting:

Confidentiality: unintended visibility and data exfiltration
Integrity: route injection or traffic tampering
Availability: misrouting/blackholing and lateral movement

Recommendation

Disable AutoAcceptSharedAttachments and require explicit approval for every attachment. Apply least privilege and separation of duties for approvers, limit shares to trusted accounts, and use defense in depth with segmentation and logging to audit the attachment lifecycle.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 modify-transit-gateway --transit-gateway-id <example_resource_id> --options AutoAcceptSharedAttachments=disable

# Terraform: Disable auto-accept for shared attachments on a Transit Gateway
resource "aws_ec2_transit_gateway" "<example_resource_name>" {
  auto_accept_shared_attachments = "disable"  # Critical: prevents automatic acceptance of cross-account VPC attachments
}

# CloudFormation: Disable auto-accept for shared attachments on a Transit Gateway
Resources:
  <example_resource_name>:
    Type: AWS::EC2::TransitGateway
    Properties:
      Options:
        AutoAcceptSharedAttachments: disable  # Critical: turns off automatic acceptance of shared VPC attachments

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_transitgateway_auto_accept_vpc_attachments. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires