Amazon Q Business in VPC for external data sources

Hello.

Do I set up both Internet gateway and NAT gateway in my VPC?

Yes, you need to set up a NAT Gateway and Internet Gateway to access Sharepoint Online with Amazon Q via VPC.
When creating the configuration introduced in the document below, the subnet associated with Amazon Q will be a private subnet in Availability Zone B.
I think that by doing this, Amazon Q would be routed to the NAT Gateway and access Sharepoint Online using the Elastic IP address of the NAT Gateway.
https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-scenarios.html#public-nat-internet-access

When creating a connector on Amazon Q, please perform the settings in step 10 of the document below.
https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/sharepoint-cloud-console.html

10. Configure VPC and security group – optional – Choose whether you want to use a VPC. If you do, enter the following information:
a. Subnets – Select up to 6 repository subnets that define the subnets and IP ranges the repository instance uses in the selected VPC.
b. VPC security groups – Choose up to 10 security groups that allow access to your data source. Ensure that the security group allows incoming traffic from Amazon EC2 instances and devices outside your VPC. For databases, security group instances are required.