EC2 Elastic Network Interfaces (ENIs)
A Complete Guide to Virtual Network Interfaces for EC2 Instances
What is an Elastic Network Interface?
An Elastic Network Interface (ENI) is a virtual network interface that you can attach to an EC2 instance in a VPC. It serves as a logical networking component that represents a virtual network card and can include attributes such as IP addresses, security groups, and MAC addresses.
Key Characteristics
- Virtual network card for EC2 instances
- Belongs to a specific subnet in a VPC
- Can have multiple IPv4 and IPv6 addresses
- Can be attached and detached from instances
- Maintains its attributes when detached
- Can be associated with security groups
How ENIs Work
Basic Functionality
- Each EC2 instance has a default primary ENI
- Additional ENIs can be created and attached
- ENIs are bound to a specific Availability Zone
- Traffic flows through the ENI to the instance
- Security groups control traffic at the ENI level
ENI Components
IP Addresses
ENIs can have multiple IP addresses assigned to them:
- Primary private IPv4 address
- Secondary private IPv4 addresses
- One Elastic IP per private IPv4 address
- One public IPv4 address
- Multiple IPv6 addresses
# Example IP configuration Primary IPv4: 10.0.1.25 Secondary IPv4: 10.0.1.26, 10.0.1.27 Elastic IP: 54.123.45.67 (mapped to 10.0.1.25) IPv6: 2001:db8:1234:1a00::123
Security Groups
ENIs can be associated with security groups to control inbound and outbound traffic:
- Up to 5 security groups per ENI
- Stateful packet filtering
- Rules based on protocol, port, and source/destination
- Changes take effect immediately
# Example security group rule Protocol: TCP Port Range: 443 Source: 0.0.0.0/0 Description: Allow HTTPS from anywhere
Other Attributes
Additional properties of ENIs include:
- MAC address (automatically assigned)
- Source/destination check flag
- Description (optional)
- Device index (when attached to instance)
- Delete on termination flag
# Example ENI attributes MAC: 02:1a:2b:3c:4d:5e Source/Dest Check: Enabled Description: "Web server primary interface" Device Index: 0 Delete on Termination: False
ENI Architecture Diagram
Creating Elastic Network Interfaces
Using AWS Management Console
- Navigate to EC2 in the AWS Management Console
- Select "Network Interfaces" from the left navigation
- Click "Create Network Interface"
- Select a subnet for the ENI
- Specify a private IPv4 address or let AWS assign one
- Select security groups to associate with the ENI
- Add a description (optional)
- Click "Create"
Using AWS CLI
# Create a new ENI
aws ec2 create-network-interface \
--subnet-id subnet-12345678 \
--description "Web server secondary interface" \
--groups sg-12345678 \
--private-ip-address 10.0.1.25
# Create ENI with multiple private IP addresses
aws ec2 create-network-interface \
--subnet-id subnet-12345678 \
--description "Multi-IP interface" \
--groups sg-12345678 \
--private-ip-addresses \
PrivateIpAddress=10.0.1.25,Primary=true \
PrivateIpAddress=10.0.1.26 \
PrivateIpAddress=10.0.1.27
Attaching ENIs to Instances
During Instance Launch
Attach additional ENIs when launching an EC2 instance:
- Start the EC2 instance launch wizard
- In the "Configure Instance Details" step
- Under "Network Interfaces", click "Add Device"
- Configure the additional ENI settings
- Complete the launch process
To Running Instances
Attach an existing ENI to a running or stopped instance:
- Select the ENI in the EC2 console
- Choose Actions > Attach
- Select the instance from the dropdown
- Specify a device index (if needed)
- Click "Attach"
Using AWS CLI:
# Attach ENI to running instance aws ec2 attach-network-interface \ --network-interface-id eni-12345678 \ --instance-id i-12345678 \ --device-index 1 # Detach ENI from instance aws ec2 detach-network-interface \ --attachment-id eni-attach-12345678
Managing ENI Properties
Managing IP Addresses
Add, remove, or modify IP addresses associated with an ENI:
# Assign secondary private IP address aws ec2 assign-private-ip-addresses \ --network-interface-id eni-12345678 \ --private-ip-addresses 10.0.1.28 # Assign automatically allocated IP addresses aws ec2 assign-private-ip-addresses \ --network-interface-id eni-12345678 \ --secondary-private-ip-address-count 2 # Unassign private IP address aws ec2 unassign-private-ip-addresses \ --network-interface-id eni-12345678 \ --private-ip-addresses 10.0.1.28 # Associate Elastic IP with ENI aws ec2 associate-address \ --network-interface-id eni-12345678 \ --private-ip-address 10.0.1.25 \ --allocation-id eipalloc-12345678
Modifying ENI Attributes
Change various ENI properties:
# Modify description aws ec2 modify-network-interface-attribute \ --network-interface-id eni-12345678 \ --description "Updated description" # Modify security groups aws ec2 modify-network-interface-attribute \ --network-interface-id eni-12345678 \ --groups sg-12345678 sg-87654321 # Enable/disable source/destination check aws ec2 modify-network-interface-attribute \ --network-interface-id eni-12345678 \ --no-source-dest-check # Change attachment delete-on-termination aws ec2 modify-network-interface-attribute \ --network-interface-id eni-12345678 \ --attachment AttachmentId=eni-attach-12345678,DeleteOnTermination=true
Best Practices
Network Design
- Use separate ENIs for different traffic types (management, application, etc.)
- Apply different security groups to each ENI based on its purpose
- Consider ENI placement for high availability designs
- Plan IP address allocation carefully, especially in large deployments
- Use descriptive names for ENIs to simplify management
Performance Considerations
- Be aware of instance bandwidth limits across all ENIs
- Consider enhanced networking for high-performance workloads
- Understand that multiple ENIs don't increase overall bandwidth
- Use placement groups for low-latency communication between instances
- Monitor network performance metrics for each ENI
Security Best Practices
- Apply the principle of least privilege to security group rules
- Use different security groups for different ENIs on the same instance
- Regularly audit security group rules
- Consider using network ACLs as an additional security layer
- Use VPC Flow Logs to monitor traffic to and from ENIs
Advanced Scenarios
Multi-homed Instances
Create instances with interfaces in multiple subnets for specialized networking requirements:
# CloudFormation example for multi-homed instance
Resources:
WebServerInstance:
Type: AWS::EC2::Instance
Properties:
ImageId: ami-12345678
InstanceType: t3.large
NetworkInterfaces:
- DeviceIndex: 0
SubnetId: !Ref PublicSubnet
GroupSet:
- !Ref WebSecurityGroup
AssociatePublicIpAddress: true
Tags:
- Key: Name
Value: Multi-homed Server
BackendInterface:
Type: AWS::EC2::NetworkInterface
Properties:
SubnetId: !Ref PrivateSubnet
GroupSet:
- !Ref DatabaseSecurityGroup
Description: Interface for database access
SourceDestCheck: true
Tags:
- Key: Name
Value: DB Interface
InterfaceAttachment:
Type: AWS::EC2::NetworkInterfaceAttachment
Properties:
InstanceId: !Ref WebServerInstance
NetworkInterfaceId: !Ref BackendInterface
DeviceIndex: 1
Network Appliances
Use ENIs to create network appliances like firewalls, load balancers, or NAT instances:
# Disable source/destination check for NAT instance aws ec2 modify-network-interface-attribute \ --network-interface-id eni-12345678 \ --no-source-dest-check # Route table configuration for NAT instance aws ec2 create-route \ --route-table-id rtb-12345678 \ --destination-cidr-block 0.0.0.0/0 \ --network-interface-id eni-12345678
Example network appliance architecture:
- ENI 1: Public subnet (receives traffic)
- ENI 2: Private subnet (forwards traffic)
- Traffic inspection/modification happens on the instance
- Source/destination check disabled to allow forwarding
IP Mobility with ENIs
IP Mobility Patterns
Use ENIs to implement IP mobility for high availability and failover scenarios:
- Secondary ENI Failover: Move a secondary ENI between instances
- Elastic IP Reassignment: Reassign Elastic IPs between ENIs
- Secondary IP Reassignment: Move secondary private IPs between ENIs
# Detach ENI from failed instance aws ec2 detach-network-interface \ --attachment-id eni-attach-12345678 # Attach ENI to standby instance aws ec2 attach-network-interface \ --network-interface-id eni-12345678 \ --instance-id i-87654321 \ --device-index 1
High Availability Architecture
Example architecture for high availability using ENIs:
- Primary and standby EC2 instances in different AZs
- Application ENI with important IP addresses
- Health monitoring system to detect failures
- Automation to move ENI or IPs during failover
- DNS records pointing to Elastic IP
Benefits:
- Preserves network identity during failover
- Minimizes DNS propagation delays
- Maintains existing connections (for some protocols)
- Simplifies security group management
ENI Limits and Quotas
Instance Type Limits
The number of ENIs you can attach to an instance depends on the instance type:
| Instance Type | Max ENIs | IP Addresses per ENI |
|---|---|---|
| t3.micro | 2 | 2 |
| m5.large | 3 | 10 |
| c5.xlarge | 4 | 15 |
| r5.4xlarge | 8 | 30 |
Other Limitations
- ENIs are bound to a specific Availability Zone
- Maximum of 5 security groups per ENI
- Maximum of 50 rules per security group
- Default quota of 5,000 ENIs per region (can be increased)
- Hot-attach (to running instance) may require OS configuration
- Some instance types support only IPv4 on secondary ENIs
AWS Customer Examples
Netflix
Netflix uses ENIs extensively in their microservices architecture to implement network segmentation and security. They leverage multiple ENIs on their EC2 instances to separate different types of traffic (control plane vs. data plane) and apply different security policies to each interface. This helps them maintain strict security boundaries while allowing their services to communicate efficiently.
OpenAI (ChatGPT)
OpenAI uses ENIs to optimize network traffic between their AI training clusters. By configuring multiple ENIs on their high-performance computing instances, they can separate model training traffic from management traffic, ensuring that critical AI workloads have dedicated network paths. This helps them achieve the massive scale required for training large language models like GPT.
Amazon Prime Video
Prime Video's content delivery infrastructure uses ENIs with multiple IP addresses to handle high-volume streaming traffic. Their architecture leverages ENIs to implement failover mechanisms that can quickly redirect traffic if an instance becomes unhealthy, ensuring continuous streaming service for millions of users worldwide.
Audible
Audible uses ENIs to implement network segmentation in their multi-tier application architecture. By using separate ENIs for web, application, and database tiers, they can apply specific security groups to each layer, enhancing their security posture while maintaining the flexibility to scale each tier independently.
Common Use Cases
Network Security Segmentation
Use multiple ENIs to create network security zones on a single instance:
- ENI 1: Public-facing with restrictive security group
- ENI 2: Internal-only with permissive security group
- Application components use the appropriate ENI based on their security requirements
# Security group for public-facing ENI aws ec2 create-security-group \ --group-name web-sg \ --description "Web server security group" \ --vpc-id vpc-12345678 aws ec2 authorize-security-group-ingress \ --group-id sg-web \ --protocol tcp \ --port 443 \ --cidr 0.0.0.0/0 # Security group for internal ENI aws ec2 create-security-group \ --group-name app-sg \ --description "Application security group" \ --vpc-id vpc-12345678 aws ec2 authorize-security-group-ingress \ --group-id sg-app \ --protocol tcp \ --port 8080 \ --source-group sg-internal-lb
High Availability Failover
Implement high availability using ENI mobility:
- Primary and standby instances in different AZs
- Application data synchronized between instances
- Health monitoring system checks primary instance
- On failure, ENI with Elastic IP detached from primary
- ENI attached to standby instance
- Traffic automatically flows to standby instance
#!/bin/bash
# Simple failover script
PRIMARY_INSTANCE="i-12345678"
STANDBY_INSTANCE="i-87654321"
ENI_ID="eni-12345678"
ATTACHMENT_ID="eni-attach-12345678"
# Check if primary is healthy
if ! aws ec2 describe-instance-status --instance-id $PRIMARY_INSTANCE --query "InstanceStatuses[0].InstanceStatus.Status" | grep -q "ok"; then
echo "Primary instance unhealthy, initiating failover"
# Detach ENI from primary
aws ec2 detach-network-interface --attachment-id $ATTACHMENT_ID
# Wait for detachment to complete
aws ec2 wait network-interface-available --network-interface-ids $ENI_ID
# Attach to standby
aws ec2 attach-network-interface \
--network-interface-id $ENI_ID \
--instance-id $STANDBY_INSTANCE \
--device-index 1
echo "Failover complete"
fi
Multi-IP Applications
Container Hosting
Use ENIs with multiple IP addresses to host containers:
- Assign each container its own IP address
- Simplifies port mapping and avoids port conflicts
- Enables direct container-to-container communication
- Allows fine-grained security controls per container
# Assign multiple IPs to an ENI aws ec2 assign-private-ip-addresses \ --network-interface-id eni-12345678 \ --secondary-private-ip-address-count 10 # Docker run with specific IP (on the instance) docker run --net=host --ip=10.0.1.25 nginx
Network Monitoring
Traffic Inspection
Use ENIs to implement network monitoring and traffic inspection:
- Create a monitoring ENI in promiscuous mode
- Attach to an EC2 instance running monitoring software
- Configure VPC traffic mirroring to send traffic to the ENI
- Analyze traffic for security threats or performance issues
# Create traffic mirror target aws ec2 create-traffic-mirror-target \ --network-interface-id eni-12345678 \ --description "Security monitoring target" # Create traffic mirror filter aws ec2 create-traffic-mirror-filter \ --description "Monitor all traffic" # Add filter rule aws ec2 create-traffic-mirror-filter-rule \ --traffic-mirror-filter-id tmf-12345678 \ --traffic-direction ingress \ --rule-number 100 \ --rule-action accept \ --protocol 17 \ --source-cidr-block 10.0.0.0/16 \ --destination-cidr-block 0.0.0.0/0 # Create traffic mirror session aws ec2 create-traffic-mirror-session \ --network-interface-id eni-source \ --traffic-mirror-target-id tmt-12345678 \ --traffic-mirror-filter-id tmf-12345678 \ --session-number 1
Advantages of ENIs
Flexibility and Management
- Create and manage network interfaces independently of instances
- Move ENIs between instances for failover scenarios
- Preserve IP addresses, MAC addresses, and security group settings
- Attach multiple ENIs to a single instance for different purposes
- Simplify network management in complex architectures
Security Benefits
- Apply different security groups to different ENIs on the same instance
- Create network security zones within a single instance
- Implement defense-in-depth by segmenting traffic types
- Simplify compliance with security requirements
- Monitor network traffic at a granular level
High Availability
- Implement IP mobility for failover scenarios
- Maintain network identity during instance replacement
- Minimize downtime during maintenance or failures
- Support for multiple IP addresses enables flexible scaling
- Elastic IPs can be reassigned between ENIs
Limitations of ENIs
Technical Constraints
- ENIs are bound to a specific Availability Zone
- Limited number of ENIs per instance type
- Limited number of IP addresses per ENI
- No bandwidth guarantees between ENIs
- Multiple ENIs don't increase overall instance bandwidth
Operational Challenges
- OS-level configuration may be required for secondary ENIs
- Hot-attaching ENIs may require additional setup
- IP address management can become complex
- Troubleshooting network issues across multiple ENIs is challenging
- Security group management becomes more complex
Alternative Considerations
- For cross-AZ failover, consider using load balancers instead
- For container networking, ECS/EKS offer more integrated solutions
- For high-performance networking, consider EFA or placement groups
- For simplified security, consider AWS Network Firewall or Security Groups
- For global IP mobility, consider Global Accelerator
ENIs vs. Other AWS Networking Features
| Feature | Elastic Network Interfaces | Elastic Load Balancing | Elastic IP Addresses | Elastic Fabric Adapter |
|---|---|---|---|---|
| Primary Use Case | Network interface management | Traffic distribution | Static public IP addressing | High-performance computing |
| Availability Zone Scope | Single AZ | Multiple AZs | Regional | Single AZ |
| IP Addressing | Multiple private & public IPs | Single DNS name | Single public IP | Uses ENI addressing |
| Security Controls | Security Groups | Security Groups & WAF | None (uses ENI/SG) | Security Groups |
| Failover Support | Manual (ENI movement) | Automatic | Manual reassignment | None |
| Performance | Instance-dependent | Auto-scaling | N/A | Ultra-high performance |