What should the solutions architect do to meet these requirements?

Explanations:

Updating the network ACLs can help control traffic flow, but since network ACLs are stateless, managing them for specific authorized VPCs can be cumbersome and does not provide fine-grained control over the authorized communications. Network ACLs would not be the most effective or scalable solution for limiting inter-VPC traffic in this scenario.

While updating security groups to deny outbound traffic to unauthorized VPCs can help control traffic, this approach does not address the potential for other VPCs to initiate traffic towards the current VPC. It also complicates management, as it would require constant updates whenever security groups or VPCs change. Moreover, security groups alone do not provide a comprehensive solution for inter-VPC communication restrictions.

Creating a dedicated transit gateway route table for each VPC attachment allows for precise control over which VPCs can communicate with each other. By defining specific routes to only the authorized VPCs, traffic can be effectively limited and managed according to organizational policies, ensuring compliance with the requirements of the security audit.

Updating the main route table of each VPC to route traffic only to authorized VPCs through the transit gateway would not work effectively. Route tables determine the next hop for outbound traffic but do not prevent inbound traffic from unauthorized VPCs, which could still initiate communication. This would not achieve the goal of limiting traffic between VPCs.