A company runs a public three-tier web application in a VPC on Amazon EC2 instances across multiple Availability Zones. EC2 instances in private subnets must communicate with a license server over the internet. The company wants a managed solution that minimizes operational maintenance. Which solution meets these requirements?

A NAT Gateway in a public subnet is the correct solution. It provides a managed service for instances in private subnets to initiate outbound connections to the internet while preventing inbound connections from the internet. Placing it in a public subnet ensures it has a public IP address and can route traffic to the internet. The private subnets' route tables must then be updated to direct internet-bound traffic through the NAT Gateway. NAT instances are not managed services, requiring operational overhead for patching, scaling, and high availability, which conflicts with the requirement for a managed solution. Placing a NAT Gateway in a private subnet would prevent it from accessing the internet, as private subnets lack direct internet access.