In a VPC that hosts a multi-tier application requiring IPv6 connectivity for EC2 instances in private subnets to access the Internet, but not allowing incoming Internet connections, which AWS service or feature should a Solutions Architect recommend for compliance?