Back to Checks
aws

Amazon EC2 Transit Gateway does not automatically accept shared VPC attachments

ec2_transitgateway_auto_accept_vpc_attachments
Service: ec2Severity: high
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:AwsEc2TransitGateway

EC2 Transit Gateways with AutoAcceptSharedAttachments=enable automatically approve cross-account VPC attachments.

The evaluation identifies transit gateways configured to auto-accept shared attachments.

Prowler logoProwlerprowler-provider-aws

Risk

Auto-accepting cross-account attachments can link untrusted VPCs to your routing domain, impacting:

  • Confidentiality: unintended visibility and data exfiltration
  • Integrity: route injection or traffic tampering
  • Availability: misrouting/blackholing and lateral movement

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_transitgateway_auto_accept_vpc_attachments

Recommendation

Disable AutoAcceptSharedAttachments and require explicit approval for every attachment.

Apply least privilege and separation of duties for approvers, limit shares to trusted accounts, and use defense in depth with segmentation and logging to audit the attachment lifecycle.

Remediation

CLI

aws ec2 modify-transit-gateway --transit-gateway-id <example_resource_id> --options AutoAcceptSharedAttachments=disable

Terraform

# Terraform: Disable auto-accept for shared attachments on a Transit Gateway
resource "aws_ec2_transit_gateway" "<example_resource_name>" {
  auto_accept_shared_attachments = "disable"  # Critical: prevents automatic acceptance of cross-account VPC attachments
}

NativeIaC

# CloudFormation: Disable auto-accept for shared attachments on a Transit Gateway
Resources:
  <example_resource_name>:
    Type: AWS::EC2::TransitGateway
    Properties:
      Options:
        AutoAcceptSharedAttachments: disable  # Critical: turns off automatic acceptance of shared VPC attachments

Other

1In the AWS Console, go to VPC > Transit Gateways
2Select the transit gateway and click Actions > Modify transit gateway
3Under Cross-account sharing options, uncheck Auto-accept shared attachments
4Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_transitgateway_auto_accept_vpc_attachments(Check):
    def execute(self):
        findings = []
        for tgw in ec2_client.transit_gateways.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=tgw)

            if tgw.auto_accept_shared_attachments:
                report.status = "FAIL"
                report.status_extended = f"Transit Gateway {tgw.id} in region {tgw.region} is configured to automatically accept shared VPC attachments."
            else:
                report.status = "PASS"
                report.status_extended = f"Transit Gateway {tgw.id} in region {tgw.region} does not automatically accept shared VPC attachments."

            findings.append(report)

        return findings

References