What makes a VPC subnet public or private, and why do private subnets usually need a NAT gateway?

The route table makes a subnet public or private. A route table is a list of rules that says where network traffic goes.

A VPC (Virtual Private Cloud) is your private network in one AWS Region. You divide it into subnets. Each subnet lives in one AZ (Availability Zone: one data centre area inside the Region).

• A public subnet has a route for 0.0.0.0/0 (all internet traffic) to an internet gateway. Resources in it also need a public IP to be reachable from the internet.
• A private subnet has no route to the internet gateway. So nothing on the internet can start a connection to it.

Private resources still often need outbound access. For example, they call a payment API or download packages. A NAT gateway gives them this. NAT means Network Address Translation. You place the NAT gateway in a public subnet. The private subnet then routes 0.0.0.0/0 to the NAT gateway. The NAT gateway allows outbound connections and their replies, but it blocks connections that start from outside.

NAT gateways cost money per hour and per GB processed. For high availability, you need one NAT gateway per AZ.