natkit only needs an instance role for the keys that call AWS:

  {
  "Version": "2012-10-17",
  "Statement": [
    {"Effect": "Allow", "Action": "ec2:AssociateAddress", "Resource": "*"},
    {"Effect": "Allow", "Action": ["ec2:AttachNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute"], "Resource": "*"},
    {"Effect": "Allow", "Action": "ssm:GetParameter", "Resource": "arn:aws:ssm:*:*:parameter/natkit/*"}
  ]
}

With cwagent_enabled, also attach CloudWatchAgentServerPolicy.

Scope Resource down to your EIP, ENI and instances where you can. The OpenTofu module’s role does this: tag conditions on the ENIs and instances, and the one EIP and SSM parameters by ARN.

Edit this page

Last updated 13 Nov 2026, 13:02 -0300. history