SFTP - how to tunnel to private AWS server behind AWS NAT
You can use local TCP forwarding in ssh, for example:

ssh -L 2222:private:22 user@gateway


And then connect any of your graphical tools to the private server by connecting to localhost:2222, or just use again command line sftp:

sftp private_user@localhost -P 2222