The client wants this server. It sends to the instance's public IP, 54.210.33.8, port 80. Port 51514 is one the client picked for this connection.
The instance has no public IP, so the client has no destination address that leads to it. The packet has nowhere to go and never reaches the VPC.
The packet enters the VPC here. The IGW rewrites the destination from the public IP to the instance's private IP.
10.0.0.12 is inside the VPC, so the local route, the most specific match, takes it to the subnet. The 0.0.0.0/0 → igw route is not used on the way in.
10.0.0.12 is inside the VPC, so the local route takes it to the subnet. The 0.0.0.0/0 → igw route is missing, and the way in never needs it.
At the subnet edge the NACL reads its inbound rules from the lowest number up. Port 80 matches rule 100: allowed.
At the subnet edge the NACL reads its inbound rules from the lowest number up. Nothing matches port 80, so the final * rule denies the packet.
The SG checks its inbound rules. Port 80 is allowed, so the packet goes in, and the SG remembers this connection.
No inbound rule in the SG allows port 80, so the packet is dropped. The instance never sees it.
The instance gets the request and answers. Source and destination swap: the reply goes to the client, port 51514.
The SG remembers this connection, so the reply leaves without any outbound rule being checked.
Every outbound rule is gone, and the reply still leaves. The SG remembers this connection and does not look at outbound rules for it.
The NACL does not remember connections, so it checks the reply too. Port 51514 falls in 1024–65535: allowed.
The NACL does not remember connections, so it checks the reply too. Nothing matches port 51514; the final * rule denies it, and the client waits until it times out.
203.0.113.7 is outside the VPC. Only 0.0.0.0/0 → igw matches, so the reply goes to the IGW. This route is what makes the subnet public.
203.0.113.7 is outside the VPC, and with no 0.0.0.0/0 → igw nothing matches it, so the reply is dropped. The request did reach the instance; the client only gets a timeout.
The packet leaves the VPC here. The IGW rewrites the source from the private IP back to the public IP, so the reply comes from 54.210.33.8.
The client gets the reply. The connection works.
The client gets the reply. The connection works. SG outbound rules only apply to connections the instance opens itself.