Use a NAT instance in a public VPC subnet to enable outbound internet traffic from instances in a private subnet.