Internet gateway and NAT gateway

A VPC has no path to the internet until you give it one. An internet gateway makes a subnet reachable from the internet in both directions, a NAT gateway lets private instances reach out without becoming reachable. The deciding question for any flow is who opens the connection.