CMOS devices, the class of semiconductor to which the ATmegas - and almost all current computing devices - belong, uses "insulated gate" FETs in which the gate is separated from the channel by a thin layer of dielectric, usually silicon dioxide.
As such, in normal operation, the gate draws no current from the circuit to which it is connected, except to charge or discharge its intrinsic capacitance, of the order of a few picofarads. As the dielectric could be damaged by excess voltage however, protective silicon diodes are formed into the chip between each external gate connection, Vcc and ground which conduct if the gate voltage strays more than a diode forward voltage either above Vcc or below ground, to protect against electrostatic discharge (ESD).
Finally, the internal "pull-up" is a rather small FET device added into the port circuitry between the port pin and Vcc and controlled by the output latch so that it is turned on if you write a logic "HIGH" to that latch even when the primary output drivers are disabled by setting the Data Direction Register to define it as an input. This will source a fraction of a milliamp (as a fairly constant current source) to anything that tends to pull the input pin below Vcc (or arguably, will draw the same current from any source that tends to pull it above Vcc by less than the protective diode drop as these FETs are generally symmetrical).
Unless that pull-up is enabled or the voltage strays outside of the supply limits, the input impedance is very high indeed, noting two quotes people have previously offered (presumably) from the datasheets, as a minimum of 5 megohm (1?A leakage) and a typical of 10 gigohm.