# NatInstanceProps

Properties for a NAT instance.

Extends: NatInstanceProps
Used as props by: NatInstanceProvider, NatInstanceProviderV2

- Source: [`aws-ec2/lib/nat.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-ec2/lib/nat.ts#L279)
- Type last changed: v2.164.0 · 24 Oct 2024

## Example

```ts
declare const instanceType: ec2.InstanceType;

const provider = ec2.NatProvider.instanceV2({
  instanceType,
  defaultAllowedTraffic: ec2.NatTrafficDirection.OUTBOUND_ONLY,
});
new ec2.Vpc(this, 'TheVPC', {
  natGatewayProvider: provider,
});
provider.connections.allowFrom(ec2.Peer.ipv4('1.2.3.4/8'), ec2.Port.HTTP);
```

## Properties

- `associatePublicIpAddress`: boolean — Whether to associate a public IP address to the primary network interface attached to this instance.

  **Default:** undefined - No public IP address associated

- `creditSpecification`: [CpuCredits](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CpuCredits.html) — Specifying the CPU credit type for burstable EC2 instance types (T2, T3, T3a, etc).

  **Default:** T2 instances are standard, while T3, T4g, and T3a instances are unlimited.

  The unlimited CPU credit option is not supported for T3 instances with dedicated host (`host`) tenancy.

- `defaultAllowedTraffic`: [NatTrafficDirection](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.NatTrafficDirection.html) — Direction to allow all traffic through the NAT instance by default.

  **Default:** NatTrafficDirection.INBOUND_AND_OUTBOUND

  By default, inbound and outbound traffic is allowed.

  If you set this to another value than INBOUND_AND_OUTBOUND, you must
  configure the NAT instance's security groups in another way, either by
  passing in a fully configured Security Group using the `securityGroup`
  property, or by configuring it using the `.securityGroup` or
  `.connections` members after passing the NAT Instance Provider to a Vpc.

- `instanceType`: [InstanceType](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.InstanceType.html) (required) — Instance type of the NAT instance.

- `keyName`: string — - Use `keyPair` instead - https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2-readme.html#using-an-existing-ec2-key-pair

  **Default:** No SSH access will be possible.

- `keyPair`: [IKeyPair](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IKeyPair.html) — The SSH keypair to grant access to the instance.

  **Default:** No SSH access will be possible.

- `machineImage`: [IMachineImage](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.IMachineImage.html) — The machine image (AMI) to use.

  **Default:** Latest NAT instance image

  By default, will do an AMI lookup for the latest NAT instance image.

  If you have a specific AMI ID you want to use, pass a `GenericLinuxImage`. For example:

  ```ts
  ec2.NatProvider.instance({
    instanceType: new ec2.InstanceType('t3.micro'),
    machineImage: new ec2.GenericLinuxImage({
      'us-east-2': 'ami-0f9c61b5a562a16af'
    })
  })
  ```

- `securityGroup`: [ISecurityGroup](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.ISecurityGroup.html) — - Cannot create a new security group before the VPC is created, and cannot create the VPC without the NAT provider. Set {@link defaultAllowedTraffic } to {@link NatTrafficDirection.NONE } and use {@link NatInstanceProviderV2.gatewayInstances } to retrieve the instances on the fly and add security groups

  **Default:** A new security group will be created

  ```ts
  const natGatewayProvider = ec2.NatProvider.instanceV2({
    instanceType: new ec2.InstanceType('t3.small'),
    defaultAllowedTraffic: ec2.NatTrafficDirection.NONE,
  });
  const vpc = new ec2.Vpc(this, 'Vpc', { natGatewayProvider });

  const securityGroup = new ec2.SecurityGroup(this, 'SecurityGroup', {
    vpc,
    allowAllOutbound: false,
  });
  securityGroup.addEgressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443));
  for (const gatewayInstance of natGatewayProvider.gatewayInstances) {
     gatewayInstance.addSecurityGroup(securityGroup);
  }
  ```

- `userData`: [UserData](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.UserData.html) — Custom user data to run on the NAT instances.

  **Default:** UserData.forLinux().addCommands(...NatInstanceProviderV2.DEFAULT_USER_DATA_COMMANDS); - Appropriate user data commands to initialize and configure the NAT instances