The Network Orchestration for AWS Transit Gateway solution automates the process of setting up and managing transit networks in distributed AWS environments. It creates a web interface to help control, audit, and approve (transit) network changes.
Currently when a Resource Share is created for the Transit Gateway it is configured with the Default Configuration of AllowExternalPrincipals: True
This can be a security issue and a good enhancement (which we have done ourselves by amending the Cfn) is to allow users to disable External principals by a parameter in the Hub Cloudformation and then using a condition set the AllowExternalPrincipals to false so that only AWS accounts within an Organisation can be shared access to the Transit Gateway
An example configuration to support this (I set No for default for our needs but for public generic requirements yes may still be OK)
Currently when a Resource Share is created for the Transit Gateway it is configured with the Default Configuration of AllowExternalPrincipals: True
This can be a security issue and a good enhancement (which we have done ourselves by amending the Cfn) is to allow users to disable External principals by a parameter in the Hub Cloudformation and then using a condition set the AllowExternalPrincipals to false so that only AWS accounts within an Organisation can be shared access to the Transit Gateway
An example configuration to support this (I set No for default for our needs but for public generic requirements yes may still be OK)
Add to Parameters:
Add to Conditions:
"NoExternalPrincipals": { "Fn::Equals": [ { "Ref": "AllowExternalPrincipals" }, "No" ] },
Add Property to TGW Resource Share:
"AllowExternalPrincipals": { "Fn::If": [ "NoExternalPrincipals",false,true ] },