Attached once, and it makes nothing public by itself.
A subnet needs both the route AND a public IP — miss either and it isn't really public.
1IGW attached to VPCOnce, not per subnet
→
2Route table: 0.0.0.0/0 → IGWMakes the subnet public
→
3Resource has a public/Elastic IPThe other missing half
IPv6's sibling is the Egress-Only Internet Gateway: outbound-only, since IPv6 addresses are globally routable and need no NAT translation at all.