How Can I Update My Windows VM in a Private Subnet?

If you go with the WSUS approach, remember that you need an update server that your Windows instance can connect to. That can be either a WSUS server that has Internet access or one you set up on your VPC.

Consider using a WSUS (Windows Server Update Services) server. Your instance can use this server for updates instead of going directly to the Internet. You can set it up within your VPC if you don't want your machines to access the public Internet.

You'll need some way to connect to the Internet, like setting up a NAT Gateway. This can allow your Windows VM to access updates while remaining in a private subnet.

So, just a recap: you can either set up a NAT Gateway for direct Internet access or create a WSUS server in your network to manage updates for your VMs.