Octet

Say this first

An internet gateway gives a VPC two-way internet access for instances that have public IPs; it does one-to-one NAT between the public and private address. A NAT gateway lets instances with only private addresses start outbound connections and share one Elastic IP, while blocking inbound connections. A standard NAT gateway is zonal, sits in a public subnet, and needs its own route to the internet gateway.

Go deeper

Internet gateway (IGW)

One per VPC, highly available by design, no bandwidth knob to size.
Does static 1:1 NAT for instances with public IPv4 or Elastic IPs. The instance OS only ever sees its private address.
For IPv6 there is no NAT. An egress-only internet gateway gives outbound-only IPv6, which is the IPv6 equivalent of a NAT gateway's protection.

NAT gateway

A standard (zonal) NAT gateway is created in one subnet of one AZ. A public one has an Elastic IP and must sit in a public subnet (route 0.0.0.0/0 to the IGW).
Private subnets route 0.0.0.0/0 to it. It translates source address and port (PAT).
Supports up to 55,000 simultaneous connections to each unique destination (IP, port, protocol).
For AZ resilience you deploy one per AZ and point each private subnet at the NAT gateway in its own AZ. One shared NAT gateway is a single point of failure and adds cross-AZ data charges.
A private NAT gateway has no Elastic IP and translates to its private address. It is used to reach other networks (for example through a transit gateway) when address ranges overlap.
You cannot attach a security group to it. The subnet's network ACL still applies.

Equivalents

Azure: NAT Gateway, a managed resource associated with subnets, using public IPs or prefixes. Each public IP gives 64,512 SNAT ports.
GCP: Cloud NAT, configured on a Cloud Router. It is software-defined: there is no NAT box in the data path, the translation happens in the host networking stack.

They will ask next

Why does a NAT gateway have to be in a public subnet?
It forwards translated traffic using its own subnet's route table. If that table has no 0.0.0.0/0 to the internet gateway, the NAT gateway has nowhere to send packets.
Can you use a NAT instance instead?
Yes, an EC2 instance with IP forwarding, source/destination check disabled, and iptables masquerade. It is cheaper at low volume but you own its availability, patching and throughput.

Traps

Placing the NAT gateway in a private subnet. It looks healthy and nothing works.
Assuming a zonal NAT gateway survives an AZ failure. It lives in one AZ.

How did you do?