Network Address Translation Gateway - allows private subnet resources to access the internet without being directly accessible from the internet. Like a secure mailroom that can send packages out but doesn't accept unsolicited deliveries.
Database servers in private subnets use a NAT Gateway to download software updates while remaining protected from direct internet access.
All provide outbound internet access for private resources without allowing unsolicited inbound connections. AWS/Azure/OCI use a managed NAT gateway resource; GCP uses Cloud NAT configured on a Cloud Router for subnets.