Private EC2 instances must download patches from the internet but must never accept inbound internet connections. What should you configure?