In AWS, a NAT gateway/instance allows your instances in a private subnet to make outbound connections to the internet (to download software for example), but if you want to SSH into your instances in your private subnet from the internet, you need to use a [...] host/server

Bastion

^^ Bastion host is in the public subnet, since it needs a public IP, to be an SSH entry point from internet to then tunnel the traffic to the private IP of your instance in private subnet.
^^^ You must use bastion as jumphost to access your EC2 instances in private subnet (since these instances don't have a public IP), but you can also use the bastion host as jumphost for instances in your public subnet too (as a good security measure).