Networking / VPC / Controls / v2026.11
Restrict Peering and Transit Attachments to Authorized Accounts
CCC.VPC.CN03 · Networking
Ensure VPC peering connections and transit hub attachments are only established with explicitly authorized destinations to limit network exposure and enforce boundary controls.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.VPC.CP11 | Connectivity Options - VPC Peering | The service can establish a private peering connection between two virtual networks so that their resources communicate using private addresses. |
| CCC.VPC.CP12 | Connectivity Options - Transit Hub | The service can connect multiple virtual networks and on-premises networks through a central transit hub in a hub-and-spoke model. |
Related Threats
| ID | Title | Description |
|---|
| CCC.VPC.TH03 | Network Access is Granted Through Unauthorized Peering or Transit Attachments | Unauthorized peering connections or transit hub attachments can allow network traffic between untrusted or unapproved subscriptions, leading to potential data exposure or exfiltration. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.VPC.CN03.AR01 | When a VPC peering connection is requested, the service MUST prevent connections from VPCs that are not explicitly allowed. | tlp-green, tlp-amber, tlp-red |
| CCC.VPC.CN03.AR02 | When a network is attached to a transit hub, the service MUST reject attachments from accounts that are not explicitly allowed. | tlp-green, tlp-amber, tlp-red |