In the diagram given below:

We have one instance in a private subnet

We have one instance in a public subnet

We have a NAT Gateway

We have 2 different security groups; one in each subnet.

The network ACL is allowing all the traffic in and out by default.

General Guidance: you normally can associate one subnet with one NACL, you cannot associate one subnet to multiple NACLs.

However, a network ACL can be associated with multiple subnets.