AWS vpc: Document IAM permissions and access control for 1:1 NAT

Service: vpc · 2026-10-23 · Documentation high

File: vpc/latest/tgw/transit-gateway-authentication-access-control.md · Type: iam

Summary

Adds a 'Permissions for 1:1 NAT' section stating that only the transit gateway owner can view or modify attachment NAT configuration (even for RAM-shared attachments), a caller/result table for Get/ModifyTransitGatewayAttachmentNatConfiguration and NatGatewaySupport, the two IAM actions with resource-level permission support, and a least-privilege example policy scoped by attachment ARN and a tag condition.

Security assessment

The change documents authorization boundaries for a new NAT configuration API: owner-only access, explicit IAM actions (noting ec2:Describe* does not cover GetTransitGatewayAttachmentNatConfiguration), resource-level permissions on the attachment ARN, and a tag-conditioned least-privilege policy example. This is security/authorization documentation with direct access-control implications, though it does not reference a specific vulnerability or CVE.

Evidence

+Only the transit gateway owner can view or modify the NAT configuration of an attachment. This applies to every attachment on the transit gateway, including attachments owned by other accounts through AWS RAM sharing. Attachment owners can't view or change NAT configuration, and the transit gateway owner can't delegate this to them. The following table shows the result for each caller.

Diff

diff --git a/vpc/latest/tgw/transit-gateway-authentication-access-control.md b/vpc/latest/tgw/transit-gateway-authentication-access-control.md
index 4a6fe03..3aadffd 100644
--- a//vpc/latest/tgw/transit-gateway-authentication-access-control.md
+++ b//vpc/latest/tgw/transit-gateway-authentication-access-control.md
@@ -7 +7 @@
-Example policies to manage transit gateways
+Example policies to manage transit gatewaysPermissions for 1:1 NAT
@@ -129,0 +130,39 @@ JSON
+## Permissions for 1:1 NAT
+
+Only the transit gateway owner can view or modify the NAT configuration of an attachment. This applies to every attachment on the transit gateway, including attachments owned by other accounts through AWS RAM sharing. Attachment owners can't view or change NAT configuration, and the transit gateway owner can't delegate this to them. The following table shows the result for each caller.
+
+Caller | `GetTransitGatewayAttachmentNatConfiguration` / `ModifyTransitGatewayAttachmentNatConfiguration` | `NatGatewaySupport` in `DescribeTransitGatewayAttachments`  
+---|---|---  
+transit gateway owner | Allowed | Included  
+Attachment owner (different account) | `UnauthorizedOperation` | Not included  
+Any other account | `InvalidTransitGatewayAttachmentID.NotFound` | Attachment not returned  
+  
+The following table lists the IAM actions for 1:1 NAT.
+
+Action | Purpose  
+---|---  
+`ec2:ModifyTransitGatewayAttachmentNatConfiguration` | Enable or disable NAT, and set NAT rules and route options.  
+`ec2:GetTransitGatewayAttachmentNatConfiguration` | View NAT configuration. Policies that grant `ec2:Describe*` don't include this action.  
+  
+Both actions support resource-level permissions on the transit gateway attachment. To restrict which attachments a principal can manage, specify the attachment ARN or use tag-based conditions.
+
+The following example allows NAT management only on attachments tagged `environment=prod`.
+    
+    
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Action": [
+            "ec2:ModifyTransitGatewayAttachmentNatConfiguration",
+            "ec2:GetTransitGatewayAttachmentNatConfiguration"
+          ],
+          "Resource": "arn:aws:ec2:*:*:transit-gateway-attachment/*",
+          "Condition": {
+            "StringEquals": { "ec2:ResourceTag/environment": "prod" }
+          }
+        }
+      ]
+    }
+