A network segment without direct internet access, keeping resources hidden from external traffic. Like a back office that visitors can't access directly - employees can go out through controlled exits, but no one can walk in from the street.
Database servers and backend APIs are placed in private subnets so they can't be directly attacked from the internet, while still communicating with public-facing web servers.
All major clouds implement private subnets as regular subnets/subnetworks that lack a direct route from the internet (no public IP exposure and no inbound path from an Internet Gateway). Outbound internet access, if needed, is provided through controlled egress such as NAT or a firewall, while inbound access typically comes only from other internal subnets, VPN, or private connectivity.