A solutions architect is configuring a VPC that has public subnets and private subnets. The VPC and subnets use IPv4 CIDR blocks. There is one public subnet and one private subnet in each of three Availability Zones (AZs). An internet gateway is attached to the VPC. The private subnets require access to the internet to allow Amazon EC2 instances to download software updates. Which solution will meet this requirement?