Unless required, your instances should not be publicly exposed to the Internet. When your instances are on the Internet, you have to assume that they will be attacked at some stage.
This means most of your workloads should run on instances in private subnets. Private subnets are those that are not connected directly to the Internet.
In order to give your private instances access to the Internet you use network address translation (NAT). A NAT gateway allows your instances to initiate a connection to the Internet, without allowing connections from the Internet.
