If you create an isolated subnet in a VPC using the awsx.ec2.vps crosswalk is that visible to the other subnets automatically or do you need to add a NAT?

it's isolated, it has no access to the internet but there should be internal routes: https://github.com/pulumi/pulumi-awsx/blob/cb9693ae7ca99de21e917d98e8f0d001238ca691/nodejs/awsx/ec2/README.md#subnets

Do you know how I can confirm there are internal routes?

every subnet gets a default "local" route which will be routeable in the VPC, that's the way the aws networking works: https://medium.com/@mda590/aws-routing-101-67879d23014d see point 2 here

Thank you!