Use a NAT gateway in a public VPC subnet to enable outbound internet traffic from instances in a private subnet.