EC2 Transit Gateways should not automatically accept VPC attachment requests

How to fix it

Have AutoAcceptSharedAttachments disabled on the transit gateway, so a cross-account VPC attachment request waits to be accepted rather than joining the network on arrival.

In the console

VPC → Transit Gateways → the transit gateway → Actions → Modify transit gateway

With the AWS CLI

aws ec2 modify-transit-gateway --transit-gateway-id <tgw-id> --options AutoAcceptSharedAttachments=disable

With Terraform

resource "aws_ec2_transit_gateway" "this" {
  auto_accept_shared_attachments = "disable"
}