A developer updated an AWS Lambda function to run inside a VPC private subnet so it can group data from public APIs. The VPC has an internet gateway attached and uses default network ACL and security group settings. After the change, the Lambda function can no longer reach the public APIs even though the APIs are reachable. How should the developer restore outbound internet access for the Lambda function?

When a Lambda function runs in a private subnet, it loses direct internet access. To reach public APIs, it needs a mechanism to route outbound traffic to the internet. A NAT gateway in a public subnet provides this by allowing instances in private subnets to initiate outbound connections to the internet while preventing unsolicited inbound connections. Incorrect options: Allowing outbound traffic in the network ACL or security group is necessary but insufficient. These control traffic flow within the VPC but don't provide a path to the internet from a private subnet. A new internet gateway cannot be attached to a private subnet. Internet gateways are attached to the VPC and primarily used by public subnets.