What I've used NAT for (for example in AWS), is that I've split the virtual network into "public" and "private" subnets. Public subnets are behind an internet g

What I've used NAT for (for example in AWS), is that I've split the virtual network into "public" and "private" subnets. Public subnets are behind an internet gateway and are open to the internet, private ones are either only private with no internet access or behind a NAT gateway to allow connections to internet but not the other way around. My understanding has been that it's common practice, segmenting a network like that. I obviously would still configure firewalls for the devices in those different subnets, but what is this kind of NAT usage called if not security enhancement? One thing that came to my mind typing this is, that the fact that there's NAT in there could mask problems with the firewall configuration, if one does not truly test whether the firewall rules are strict enough or not. So if those private subnets behind NAT would somehow magically be switched behind an internet gateway, security holes could emerge.