AWS network-manager: Note on require-attachment-acceptance and tag-driven attachment changes
Summary
Adds a note warning that when require-attachment-acceptance is false for a segment, attachments can be added to or removed from that segment automatically as their tags change, and recommends setting it to true if that behavior is not desired.
Security assessment
Documents the security-relevant behavior of a network access control setting: with acceptance disabled, tag changes can silently onboard attachments into a segment (or remove them), which can widen network reachability without an approval gate. It is hardening/advisory guidance rather than a fix for a specific vulnerability, so it is not security_issue_related but does add security documentation.
Evidence
+If `require-attachment-acceptance` is `false` for a segment, it's still possible for attachments to be added to or removed from a segment automatically when their tags change. If this behavior is not desired, set `require-attachment-acceptance` to `true`.
Diff
diff --git a/network-manager/latest/cloudwan/cloudwan-shared-attachments.md b/network-manager/latest/cloudwan/cloudwan-shared-attachments.md index 5d0c75aa7..80c0e8bba 100644 --- a//network-manager/latest/cloudwan/cloudwan-shared-attachments.md +++ b//network-manager/latest/cloudwan/cloudwan-shared-attachments.md @@ -16,0 +17,4 @@ A shared core network currently supports only VPC, transit gateway route table, +###### Note + +If `require-attachment-acceptance` is `false` for a segment, it's still possible for attachments to be added to or removed from a segment automatically when their tags change. If this behavior is not desired, set `require-attachment-acceptance` to `true`. +