A migration requires outbound access to public package repositories from private target instances. What should be configured?

1. A service gateway used for arbitrary public internet destinations.
2. Only an IAM group with a repository-like name.
3. A public bucket containing administrator keys.
4. A NAT gateway path with appropriate routes and egress rules.