To run the CloudWatch agent, set these user-data keys:

  cwagent_enabled: true
cwagent_cfg_param_name: /natkit/cwagent   # SSM parameter with the agent's JSON config

The instance role also needs CloudWatchAgentServerPolicy and ssm:GetParameter on the parameter.

The agent image is not in the AMI. natkit pulls it by digest from public.ecr.aws at boot, only when the agent is enabled, through the NAT’s own egress. It is about 150 MB unpacked and stays in memory: use at least a t4g.micro or t3.micro.

Edit this page

Last updated 13 Nov 2026, 13:02 -0300. history