Private application instances need outbound access to public package repositories, but no instance should have a public IP. Which design is appropriate?

1. Route arbitrary internet traffic only through a service gateway
2. Route permitted internet-bound traffic through a NAT gateway
3. Assign a public IP to every application instance
4. Add an Object Storage lifecycle rule to the subnet