A multi-tier ecommerce application uses an Application Load Balancer in public subnets, a web tier in public subnets, and a MySQL cluster on Amazon EC2 instances in private subnets. The MySQL database must retrieve product catalog and pricing data hosted on the internet by a third-party provider. Design a strategy that maximizes security without increasing operational overhead. What should the solutions architect do?

Deploying a NAT gateway in the public subnets and routing private subnet traffic through it allows the MySQL instances to initiate outbound connections to the internet for product data while remaining inaccessible from the internet. This maximizes security by keeping the database instances in private subnets. NAT gateways are highly available and managed by AWS, minimizing operational overhead compared to a NAT instance, which requires manual management and scaling. Attaching an internet gateway directly to private subnets would expose the database instances to the internet, compromising security. A virtual private gateway is used for VPN connections, not for outbound internet access from private subnets.