1. NAT Gateways allows instances in the private subnet to access internet (inside to outside), we can't initiate session to private instances via NAT Gateway 2. NAT Instance(Router) can be used, we can configure port forwarding(accessing to the public IP/elastic IP of NAT instance will forward traffic to private IP of private instance) 3. VPN - allows to access private subnet instances directly