A company runs a public three-tier web application in a VPC. The application runs on Amazon EC2 instances across multiple Availability Zones. The EC2 instances that run in private subnets need to communicate with a license server over the internet. The company needs a managed solution that minimizes operational maintenance. Which solution meets these requirements?

1. Provision a NAT instance in a public subnet. Modify each private subnet's route table with a default route that points to the NAT instance.
2. Provision a NAT instance in a private subnet. Modify each private subnet's route table with a default route that points to the NAT instance.
3. Provision a NAT gateway in a public subnet. Modify each private subnet's route table with a default route that points to the NAT gateway.
4. Provision a NAT gateway in a private subnet. Modify each private subnet's route table with a default route that points to the NAT gateway.