Power BI DataGateway for AWS Redshift

Hi, 

I was configuring a Power BI Data Gateway to AWS Redshift using these solutions: https://aws.amazon.com/blogs/big-data/integrate-power-bi-with-amazon-redshift-for-insights-and-analytics/ and https://d1.awsstatic.com/whitepapers/using-microsoft-power-bi-with-aws.pdf?did=wp_card&trk=wp_card.  In short, I need to 

1. Launch an EC2 Windows instance in the same private subnet of the Redshift cluster.
2. Download and install Microsoft On-premises Data Gateway in the EC2 instance.
3. Configure the network including NAT gateway and Internet gateway for the VPC. 
4. Configure the data gateway in Power BI Service using the organizational account. 

However, I only completed step 1, 2 and 4, then the Power BI Service was able to reach the On-prem Data Gateway and get the latest data from Redshift and refresh the dashboard. This raised some security concerns: the Windows EC2 instance is under a private subnet in a VPC which only allows outbound traffic and doesn't allow inbound traffic, then how does the Data Gateway get request and retrieve and send the data to Power BI Service? 

I need to understand how the Data Gateway works and how the networking flows in this scenario then I am more comfortable with this solution.