How does a NAT Gateway allow resources in a private subnet to access the internet for outbound connections while remaining unreachable from inbound internet traffic?

A NAT Gateway is placed in a public subnet and allows instances in a private subnet to initiate outbound connections to the internet, such as downloading software updates, by translating their private IP addresses to the NAT Gateway's own public IP address, while preventing any unsolicited inbound connections from the internet from ever reaching those private instances directly, giving you outbound internet access without compromising the security benefit of keeping those resources otherwise fully isolated from direct inbound access.

aws ec2 create-nat-gateway --subnet-id subnet-12345 --allocation-id eipalloc-12345