Associating external IP to GCP instances via Terraform modules

Question

I'm using some of the Terraform modules to create GCP instances, leveraging templates.

However, I can't for the life of me get the external IPs added via the documented access_config block in the instance - it only works if I put it in the template (which kinda defeats the point given that each instance will have its own IP). Here's an example of the code... any help on what I'm doing wrong would be appreciated! (and ideally it's not "just the raw resources" --- I'm trying to leverage some of the GCP best practices buried within the modules if possible).

module "vm_template" {
  source  = "terraform-google-modules/vm/google//modules/instance_template"

  region = var.region
  project_id = var.project
  subnetwork = module.vpc.subnets_ids[1] # public
  subnetwork_project = var.project

  machine_type = "e2-micro"
  source_image         = "ubuntu-2004-focal-v20230918"
  source_image_family  = "ubuntu-2004-lts"
  source_image_project = "ubuntu-os-cloud"

  disk_size_gb = 10
  disk_type    = "pd-standard"
  auto_delete  = true

  service_account = {
    email = module.service_accounts.email
    scopes = ["cloud-platform"]
  }

  metadata = {
    ssh-keys = "ubuntu:${file("~/.ssh/id_ed25519.pub")}"
    startup-script = file("./startup-script.sh")
  }

# this works if it's here but that's so wrong...
  access_config = [{
    nat_ip       = module.puckatron_mail_address.addresses[0]
    network_tier = "PREMIUM"
  }]
}

module "mail_instance" {
  source  = "terraform-google-modules/vm/google//modules/compute_instance"

  region = var.region
  num_instances = 1
  hostname = "mail"

  deletion_protection = false

  instance_template = module.vm_template.self_link

  # this appears to do nothing
  static_ips = [module.mail_address.addresses[0]]

  # this should work, but doesn't.
  access_config = [{
    nat_ip       = module.mail_address.addresses[0]
    network_tier = "PREMIUM"
  }]
}

module "mail_address" {
  source     = "terraform-google-modules/address/google"
  version    = "~> 3.1"
  project_id = var.project
  region     = var.region
  names      = ["mail-ip"]
  address_type = "EXTERNAL"
  global = false
}

Tried:

• All flavors of putting the access_config with the instance - no avail.
• Added static_ips to see if that would help, but it doesn't.