cloudposse / terraform-aws-transit-gateway

Terraform module to provision AWS Transit Gateway, AWS Resource Access Manager (AWS RAM) Resource, and share the Transit Gateway with the Organization or another AWS Account.
https://cloudposse.com/accelerate
Apache License 2.0
53 stars 47 forks source link

Dangerous default: auto_accept_shared_attachments #28

Open nate-selzer opened 2 years ago

nate-selzer commented 2 years ago

Found a bug? Maybe our Slack Community can help.

Slack Community

Describe the Bug

By default, this module deploys a transit gateway that automatically accepts any vpc attachment requests. I believe this default is dangerous, because if an attacker knows your account ID and tgw id, they can send an attachment request and have access to your network.

Expected Behavior

I think this model should instead use the aws_ec2_transit_gateway_vpc_attachment_accepter terraform resource to accept the attachment request, and have the default be to disable automatic attachments.

Steps to Reproduce

Steps to reproduce the behavior:

  1. Deploy a transit gateway.
  2. From a theoretical attackers account, initiate a peering request
  3. The peering request is automatically accepted

Screenshots

N/A

Environment (please complete the following information):

N/A

Additional Context

N/A