1 Answers
A pvt instance can only be accessed either by a VPN connection or another instance in the same VPC (using the default local route).
DMZ/Bastion- You dont necessarily need DMZ – it is just a specific use case of access.
NAT Gtwy has nothing to do with inbound (or even pvt) access – it is only for outbound.
Pvt Key (used only for key based access – recommended approach) – your key should be installed in the target (pvt) server.
There are other advanced scenarios – peering connection, pvt interface etc.
You can use a bastion server and launch it in public subnet. From that server you login into your private server.