Let the private tier out without letting the internet in
The app servers are safely in a private subnet. Now they need to call a payment provider's API and download security patches — outbound only. Nothing on the internet should ever be able to open a connection to them.
Someone's first instinct is to give them public IPs. That works, and it also makes them reachable, which is the whole thing you were avoiding.
Boundaries, outermost first: VPC (10.0.0.0/16): Internet GW (on the VPC) Private subnet: App server (private; FAILED: no egress) Public subnet: an empty slot for the outbound path Outside every boundary: Payment API (third party) Connections: App server sends outbound traffic to outbound path — outbound only (step 1) outbound path sends outbound traffic to Internet GW (step 2) Internet GW sends outbound traffic to Payment API (step 3) Payment API must NOT reach App server — can never be initiated