Skip to main content
This lesson demonstrates how to work with Elastic Network Interfaces (ENIs) in AWS. ENIs let you store networking configuration—subnet, private IP addresses, and security groups—as a separate AWS resource. You can then attach an ENI to EC2 instances, move it between instances in the same Availability Zone (AZ), or associate an Elastic IP (EIP) so the public address travels with the interface.

​
What is an ENI?

An ENI encapsulates network configuration so you can decouple networking from an instance’s lifecycle. Typical use cases:
  • Preserve private IPs and security groups when replacing instances
  • Move a public IP between instances by attaching an EIP to the ENI
  • Add additional NICs to instances to separate traffic or host multiple services

​
Create a network interface (console)

Steps to create an ENI from the EC2 console:
  1. Open EC2 -> Network Interfaces -> Create network interface.
  2. Add a description (for example, “My EC2 interface”), choose a subnet, and decide whether to auto-assign a private IP or specify one manually.
  3. Assign the security group(s) you want applied to the ENI (for example, Web SG).
  4. Create the network interface.
After creating the ENI you can attach it to an existing EC2 instance — the instance inherits the ENI’s private IP, security groups, and other settings.
A screenshot of the AWS EC2 console with an "Attach network interface" dialog open. The dialog shows a network interface ID and an instance selection dropdown (listing an instance named "jumpserver").

​
Associate an Elastic IP with an ENI

You can associate an Elastic IP (EIP) directly to an ENI. When an EIP is bound to an ENI, the public IP follows the ENI — move the ENI to another instance in the same AZ and the public IP moves with it.
A screenshot of the AWS EC2 console on the "Associate Elastic IP address" page showing association details for a network interface and a dropdown list of available Elastic IP addresses. The page includes "Cancel" and "Associate" buttons at the bottom.

​
Launch an instance and attach an existing ENI

When launching a new EC2 instance you normally create a default network interface (device index 0). Instead of creating a new ENI, you can attach an existing one during launch:
  • In the Launch Instance wizard, open Network settings -> Advanced Network Configuration.
  • By default, device index 0 is shown. Choose the existing ENI by its ID if you want the instance to use that ENI’s configuration.
  • Note: if you select an existing ENI at launch, you do not choose security groups in the launch dialog — the ENI’s security groups are used.
Screenshot of the AWS EC2 "Launch Instances" console showing a security group being created with an SSH (TCP port 22) inbound rule set to Anywhere (0.0.0.0/0). The right panel shows the instance summary (Amazon Linux AMI, t2.micro) and a "Launch instance" button.
The console shows the network interface configuration for the instance. You can replace the default new ENI with an existing ENI by selecting it in the subnet/interface dropdown.
A screenshot of the AWS EC2 "Launch Instance" web console showing network interface settings and subnet/interface dropdowns. The right-hand summary panel lists the chosen AMI, instance type (t2.micro), storage, and a "Launch instance" button.
After launching, select the instance and check the Networking section. If the attached ENI had no public IP and no EIP, the instance will show only the private IP(s) (public IPs are normally provided via NAT unless you associate an EIP).
A screenshot of the AWS EC2 "Launch Instance" console showing the selected instance type (t2.micro) with pricing and configuration options. The left side displays key-pair and network settings while the right summary panel shows the AMI, instance type, storage and a "Launch instance" button.

​
Add a second (secondary) ENI to a running instance

You can attach additional ENIs to a running instance, provided:
  • The instance type supports multiple ENIs.
  • The ENI is in the same Availability Zone (AZ) as the instance.
ENIs must be in the same Availability Zone as the instance you attach them to. Subnets must be within that AZ.
Create another ENI (for example, “ENI two”) in the same subnet/AZ and assign whichever security groups you require. Optionally associate an Elastic IP with the new ENI.
Screenshot of the AWS EC2 console on the "Create network interface" page showing fields for Description ("nic-2"), Subnet selection, Private IPv4 (Auto-assign) and Elastic Fabric Adapter. The lower panel lists security groups including entries like "web-sg" and "launch-wizard-15."
Attach the secondary ENI via Instances -> select instance -> Networking -> Attach network interface. The console may display warnings depending on instance networking features (for example, ENA/ENA Express support).
A screenshot of the AWS EC2 console on the "Attach network interface" page, showing an instance ID, a dropdown to select a network interface (eni-...), and a notice that the selected instance type does not support ENA Express.
On successful attach, the instance will have multiple network interfaces. If one of the ENIs has an EIP, you can connect to the instance via that public IP.
Check instance limits for the number of ENIs and secondary private IPs per ENI for your instance type. See the AWS ENI limits in the EC2 documentation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

​
Example SSH session

If an ENI has an Elastic IP associated, you can SSH using that public address:
List network interfaces on the instance with ip addr to verify all attached ENIs and their private IPs:
Note: public IPs are generally handled via AWS NAT. The instance itself usually only shows private IPs unless an EIP is associated with an ENI.

​
Move ENIs between instances

You can detach a secondary ENI from one instance and attach it to another instance in the same AZ. The new instance inherits the ENI’s:
  • private IP
  • associated Elastic IP (if any)
  • security groups
This makes ENIs useful for maintenance workflows or failover scenarios where you want to move a network identity between hosts without reconfiguring other systems.
You cannot detach the primary network interface (device index 0) from an instance. Only secondary ENIs can be detached and moved between instances while running. Plan primary/secondary ENI usage accordingly.
A screenshot of the AWS EC2 console showing a list of instances (including "ec2-demo-instance") with the Actions > Networking menu open and the "Attach network interface" option highlighted. The instance details pane displays public/private IPv4 addresses and elastic IP information.

​
Quick reference table

​
Summary

  • ENIs encapsulate subnet, private IP(s), and security groups as a separate resource.
  • ENIs must be in the same Availability Zone as the instance to attach.
  • Only secondary ENIs can be detached and moved between instances (primary ENI restrictions apply).
  • Elastic IPs can be associated with ENIs so the public IP travels with the interface.
  • Using ENIs decouples network configuration from instance lifecycle and simplifies moving IPs/security settings across hosts.
If you test these steps, remember the AZ constraint and that instances typically only display private IPs unless you attach an Elastic IP to an ENI.

Watch Video