Skip to main content
In this lesson we’ll cover Elastic Network Interfaces (ENIs) — what they are, how they behave, and common use cases. For the official reference, see the AWS documentation on ENIs: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html. An Elastic Network Interface (ENI) is a virtual network card that exists inside a Virtual Private Cloud (VPC) and can be attached to an Amazon EC2 instance. Conceptually, an ENI decouples an instance’s network identity and configuration from the instance itself so you can attach, detach, and move the interface between instances in the same Availability Zone (AZ) as needed. Key properties of an ENI:
  • A primary private IPv4 address from the subnet CIDR.
  • Optional IPv6 addresses.
  • One or more secondary private IPv4 addresses.
  • Optional association with an Elastic IP (EIP) or public IP.
  • A unique MAC address.
  • Configuration controls such as the source/destination check flag.
  • Security groups (the interface-level firewall).
When you launch an EC2 instance, AWS automatically creates a primary ENI for that instance. The primary ENI is presented to the instance as eth0 and receives the instance’s primary private IPv4 from the subnet. That primary IP remains attached to the primary ENI for the lifetime of that ENI.
The primary ENI (eth0) is created with the instance and cannot be detached from that instance. It is automatically deleted when the instance is terminated.

​
Primary ENI vs. Secondary ENIs

Primary ENI (eth0)
  • Automatically created at instance launch and bound to the lifecycle of that instance.
  • Receives the subnet-assigned primary private IPv4 and, if enabled, a public IP at launch.
  • Cannot be detached.
Secondary ENIs
  • Can be created independently and attached/detached to instances in the same AZ.
  • Each has a primary private IPv4 and can hold additional secondary IPs and IPv6 addresses.
  • Can have different security groups from eth0, enabling separation of traffic (management, application, multi-NIC appliances).
  • Useful for routing, HA configurations, and moving network identities between instances.
Important constraints:
  • ENIs are AZ-scoped — you cannot attach an ENI to an instance in a different Availability Zone.
  • Secondary ENIs persist until explicitly deleted and can be reattached across instances in the same AZ.
A slide diagram comparing Primary ENI (eth0) and Secondary ENI (eth1), each shown with an icon and labeled public and private IPs. The Primary lists Public 34.191.162.238 and Private 10.0.0.35; the Secondary lists Public 54.35.215.118 and Private 10.0.1.69.

​
Public IPs and Elastic IPs (EIPs)

When a subnet is configured to auto-assign public IPv4 addresses, the primary ENI will receive a public IP at instance launch. If you require a stable, portable public IP that can move with the ENI, use an Elastic IP (EIP). An EIP associated with an ENI remains attached to the ENI when you detach and reattach that ENI to another instance (in the same AZ), preserving the network identity without changing instance configuration.
A diagram titled "Elastic Network Interfaces" inside a VPC showing an Amazon EC2 icon connected to an Elastic Network Interface icon which in turn connects to an Elastic IP address.

​
Quick AWS CLI examples

Create an ENI in a subnet:
Attach an ENI to an instance:
Associate an Elastic IP to an ENI (first allocate, then associate):
Describe ENIs:

​
ENI behavior and capabilities — at a glance

VPC Flow Logs can capture ENI traffic metadata for monitoring and security auditing; send logs to CloudWatch Logs or Amazon S3:

​
Best practices and common use cases

  • Use separate ENIs for management and data traffic to isolate security groups and routing.
  • Attach secondary ENIs to implement high-availability IP failover (move EIP/ENI between instances).
  • Disable source/destination checks on ENIs when using the instance as a router/NAT appliance.
  • Apply least-privilege security groups per ENI to minimize blast radius.
  • Use ENIs to maintain network identity during instance replacement or autoscaling lifecycle operations (move the ENI to a replacement instance where appropriate).

​
References and further reading

Watch Video