ASSESS VPC PEERING RISK

Determine what VPCs are peered, which accounts are associated, and identify accounts that aren’t controlled by the enterprise.

Summary:

VPC peering connects two virtual networks within AWS. These VPCs do not need to be in the same AWS account, and can even span AWS regions. It isn’t uncommon to find VPCs peered that shouldn’t be; often leftover from previous projects. This creates operational sprawl and potential security risks by expanding the potential blast radius. This op assesses peered VPCs and can be used to identify stale connections, connections from other AWS accounts, and new connections that may not have been expected. It can optionally isolate the connected VPC by implementing a network ACL, or even dissolve the connection.