A managed service that lets instances in private subnets reach the internet (for downloading patches, for example) without being reachable from the internet. It resides in a public subnet and translates the private IPs.
Essential on SAA-C03. Pattern: EC2 in a private subnet → NAT Gateway (public subnet) → IGW → Internet. Difference from an IGW: an IGW allows bidirectional traffic; a NAT gateway only allows outbound traffic initiated from the private subnet.
NAT Gateway is a concept that can show up on the exam. Check the full guide to see it in context.