In AWS, for VPCs, instance in private subnet (that only has private IPs), goes to NAT instance/gateway, which is in [...] subnet and has a [...] IP, which can then route the traffic to internet (via IGW) and through to the internet. <- same answer for both occulsions

Public

^^ so basically the NAT translates the private IP of the instance in the private subnet to its own public IP for the request to the internet and the for the response does the opposite (i.e. translates the public IP of itself to the private IP of the instance that initiated the request). It can do this for all the various different internal IPs of all the different private Subnet instances via some fancy port trickery.