A company deploys applications into multiple VPCs attached to a Transit Gateway. Any VPC that sends internet-bound traffic must route through a shared services VPC. Each VPC subnet uses the default VPC route table pointing to the Transit Gateway; the Transit Gateway uses its default route table for VPC attachments. A security audit shows an EC2 instance in one VPC can communicate with EC2 instances in any other company VPC. Each VPC should only be able to communicate with a specific, limited set of authorized VPCs. What should the solutions architect do to enforce this?

The correct solution is to create a dedicated Transit Gateway route table for each VPC attachment and configure routes so each attachment only reaches its authorized VPCs. This approach leverages the Transit Gateway's ability to isolate routing domains. By assigning a unique TGW route table to each VPC attachment, you gain granular control over which VPCs can communicate with each other. You can then propagate routes or create static routes in each TGW route table to explicitly allow traffic only to authorized destination VPCs, effectively segmenting the network at the Transit Gateway level. Network ACLs (NACLs) are stateless and operate at the subnet level. While they can filter traffic, managing them across many subnets for inter-VPC communication would be complex and error-prone. Security groups are stateful and operate at the instance level. Explicitly denying outbound traffic to specific security groups in unauthorized VPCs would require extensive management and might not be scalable or robust enough for a dynamic environment. Modifying the main route table in each VPC would only control traffic leaving that VPC; it wouldn't prevent unauthorized VPCs from sending traffic to it if the Transit Gateway allows it.