Pick one of three fixes. Launch the build instance in a public subnet with a public IP and a proper internet gateway route so Packer can SSH in directly. Or keep it private and use a bastion host as a jump box, configuring the SSH communicator in the Packer template to go through it. Or run the Packer build from inside the VPC (e.g. a CI runner there) so it reaches the private instance directly. Do not expect the NAT gateway to route inbound SSH; that is not what it does.

Context: Stack Overflow #54772589 (accepted answer, 4 votes): the build launches the instance in a private subnet with a NAT gateway and fails with Timeout waiting for SSH. The accepted answer corrects the networking mental model: a NAT gateway gives instances outbound internet access, it does not let anything in, so Packer on the workstation can never reach the instance through it.