A NAT instance/gateway can be thought of as performing the opposite role of a bastion host, in that it allows instances in the private subnets to initiate a connection out to the internet via the NAT resource, while blocking all inbound public-initiated traffic. NAT instances/gateways are much like bastion hosts provisioned within a public subnet and are typically used to allow your private instances access to the internet for maintenance-related tasks, such as obtaining operating system updates and patch fixes, which is essential for maintaining a healthy and secure operating system.
One of the differences between a NAT instance and a NAT gateway is that the gateway is an AWS-managed resource that offers enhanced bandwidth and availability when compared to that of a NAT instance. It always requires far less administrative configuration than that of a NAT instance. The following link shows a definitive difference between a NAT gateway and a NAT instance...
