Public vs private subnet: what’s the difference and why use a NAT?

Answer

Public subnets can route to the internet (via an Internet Gateway). Private subnets have no direct inbound internet access. A NAT gateway lets instances in private subnets initiate outbound connections (e.g., to fetch updates) without being publicly reachable.