diff --git a/modules/instance_template/README.md b/modules/instance_template/README.md
index 5d3dd7a9..d502b066 100644
--- a/modules/instance_template/README.md
+++ b/modules/instance_template/README.md
@@ -13,7 +13,7 @@ See the [simple](../../examples/instance_template/simple) for a usage example.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| access\_config | Access configurations, i.e. IPs via which the VM instance can be accessed via the Internet. | <pre>list(object({<br>    nat_ip       = string<br>    network_tier = string<br>  }))</pre> | `[]` | no |
+| access\_config | Access configurations, i.e. IPs via which the VM instance can be accessed via the Internet. | <pre>list(object({<br>    nat_ip       = optional(string)<br>    network_tier = string<br>  }))</pre> | `[]` | no |
 | additional\_disks | List of maps of additional disks. See https://www.terraform.io/docs/providers/google/r/compute_instance_template#disk_name | <pre>list(object({<br>    auto_delete     = optional(bool, true)<br>    boot            = optional(bool, false)<br>    device_name     = optional(string)<br>    disk_name       = optional(string)<br>    disk_size_gb    = optional(number)<br>    disk_type       = optional(string)<br>    disk_labels     = optional(map(string), {})<br>    interface       = optional(string)<br>    mode            = optional(string)<br>    source          = optional(string)<br>    source_image    = optional(string)<br>    source_snapshot = optional(string)<br>  }))</pre> | `[]` | no |
 | additional\_networks | Additional network interface details for GCE, if any. | <pre>list(object({<br>    network            = string<br>    subnetwork         = string<br>    subnetwork_project = string<br>    network_ip         = string<br>    nic_type           = string<br>    stack_type         = string<br>    queue_count        = number<br>    access_config = list(object({<br>      nat_ip       = string<br>      network_tier = string<br>    }))<br>    ipv6_access_config = list(object({<br>      network_tier = string<br>    }))<br>    alias_ip_range = list(object({<br>      ip_cidr_range         = string<br>      subnetwork_range_name = string<br>    }))<br>  }))</pre> | `[]` | no |
 | alias\_ip\_range | An array of alias IP ranges for this network interface. Can only be specified for network interfaces on subnet-mode networks.<br>ip\_cidr\_range: The IP CIDR range represented by this alias IP range. This IP CIDR range must belong to the specified subnetwork and cannot contain IP addresses reserved by system or used by other network interfaces. At the time of writing only a netmask (e.g. /24) may be supplied, with a CIDR format resulting in an API error.<br>subnetwork\_range\_name: The subnetwork secondary range name specifying the secondary range from which to allocate the IP CIDR range for this alias IP range. If left unspecified, the primary range of the subnetwork will be used. | <pre>object({<br>    ip_cidr_range         = string<br>    subnetwork_range_name = string<br>  })</pre> | `null` | no |
diff --git a/modules/instance_template/metadata.display.yaml b/modules/instance_template/metadata.display.yaml
index 365723b0..9f0abce5 100644
--- a/modules/instance_template/metadata.display.yaml
+++ b/modules/instance_template/metadata.display.yaml
@@ -1,4 +1,4 @@
-# Copyright 2024 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/modules/instance_template/metadata.yaml b/modules/instance_template/metadata.yaml
index 3fa05336..9b4d93c5 100644
--- a/modules/instance_template/metadata.yaml
+++ b/modules/instance_template/metadata.yaml
@@ -327,7 +327,7 @@ spec:
         description: Access configurations, i.e. IPs via which the VM instance can be accessed via the Internet.
         varType: |-
           list(object({
-              nat_ip       = string
+              nat_ip       = optional(string)
               network_tier = string
             }))
         defaultValue: []
diff --git a/modules/instance_template/variables.tf b/modules/instance_template/variables.tf
index f15468df..1819c27b 100644
--- a/modules/instance_template/variables.tf
+++ b/modules/instance_template/variables.tf
@@ -375,7 +375,7 @@ variable "confidential_instance_type" {
 variable "access_config" {
   description = "Access configurations, i.e. IPs via which the VM instance can be accessed via the Internet."
   type = list(object({
-    nat_ip       = string
+    nat_ip       = optional(string)
     network_tier = string
   }))
   default = []