How to Assign Multiple Secondary IPv4s to an EC2 Interface?

Assigning multiple secondary private IPv4 addresses to a single elastic network interface on an Amazon EC2 instance is accomplished through the AWS Management Console, the AWS Command Line Interface, or the Amazon EC2 API. Once the addresses are allocated at the AWS level, modern operating systems carrying the elastic network interface configuration service configure the addresses automatically, whereas older operating systems require manual network configuration inside the guest environment. This article walks through the instance limits, allocation steps, and operating system verification required to bind multiple private IPv4 addresses to a single network interface.

Prerequisites and Instance Type Limits

Before adding secondary private IPv4 addresses, confirm that your instance type supports the required number of IP addresses per Elastic Network Interface (ENI). Every EC2 instance family imposes a specific quota on both the maximum number of network interfaces that can be attached and the maximum number of private IPv4 addresses allowed per interface.

If an instance type supports \(N\) total private IPv4 addresses on a single interface, one address is designated as the primary private IPv4 address, leaving \(N - 1\) slots available for secondary private IPv4 addresses. Additionally, all secondary IPv4 addresses assigned to an ENI must come from the CIDR block of the subnet to which that ENI is attached.

You can check the maximum private IPv4 capacity for a given instance type using the AWS CLI:

aws ec2 describe-instance-types \
    --instance-types t3.medium \
    --query "InstanceTypes[*].NetworkInfo.{MaxInterfaces:MaximumNetworkInterfaces,IPv4PerInterface:Ipv4AddressesPerInterface}" \
    --output table

Method 1: Using the AWS Management Console

You can assign secondary private IPv4 addresses either during the launch of a new EC2 instance or to an existing network interface attached to a running or stopped instance.

Assigning to an Existing Instance

  1. Sign in to the AWS Management Console and open the Amazon EC2 console.
  2. In the left navigation pane, choose Network Interfaces under the Network & Security section (or select Instances, choose your instance, open the Networking tab, and select the target Network Interface ID).
  3. Select the Elastic Network Interface (ENI) to which you want to add secondary IPv4 addresses.
  4. Click the Actions dropdown menu and select Manage IP addresses.
  5. Expand the details for the target network interface.
  6. Under IPv4 Addresses, click Assign new IP address.
  7. Leave Auto-assign selected to let AWS pick an available address from the subnet, or enter a specific IPv4 address that falls within the subnet's CIDR range. Repeat this step to add additional secondary IPv4 addresses up to your instance limit.
  8. Click Save to apply the changes.

Method 2: Using the AWS CLI

The assign-private-ip-addresses command enables fast assignment of either automatically selected or explicitly specified secondary private IPv4 addresses to an existing Elastic Network Interface.

Auto-Assigning Multiple Secondary IPv4 Addresses

To let Amazon VPC automatically select and assign a specific count of available IPv4 addresses from the subnet range, use the --secondary-private-ip-address-count parameter:

aws ec2 assign-private-ip-addresses \
    --network-interface-id eni-0123456789abcdef0 \
    --secondary-private-ip-address-count 2

Assigning Specific Secondary IPv4 Addresses

To bind specific IPv4 addresses from the subnet CIDR range, pass them as a space-separated list to the --private-ip-addresses parameter:

aws ec2 assign-private-ip-addresses \
    --network-interface-id eni-0123456789abcdef0 \
    --private-ip-addresses 10.0.1.25 10.0.1.26

Allowing IP Reassignment Across Interfaces

If you are migrating a secondary private IPv4 address from another network interface in the same subnet for failover purposes, include the --allow-reassignment flag:

aws ec2 assign-private-ip-addresses \
    --network-interface-id eni-0123456789abcdef0 \
    --private-ip-addresses 10.0.1.25 \
    --allow-reassignment

Method 3: Configuring Within the Guest Operating System

When you attach a secondary private IPv4 address in the AWS control plane, the instance's operating system must recognize the new address on its local network adapter.

Automatic Configuration on Modern Linux AMIs

Amazon Linux 2023, Amazon Linux 2, and modern Ubuntu or RHEL AMIs include the ec2-net-utils or amazon-ec2-net-utils package (or systemd-networkd rules integrated with EC2 instance metadata). These utilities query the Instance Metadata Service (IMDS) and automatically configure newly assigned secondary IPv4 addresses on the primary interface without requiring manual intervention or a reboot.

Verify that the operating system recognizes the secondary addresses by running:

ip addr show dev ens5

(Replace ens5 with eth0 or your specific interface name if different). You will see multiple inet entries listed under the same network interface.

Manual Configuration on Linux (If Automatic Detection Is Disabled)

If your Linux distribution does not automatically pull secondary IPs from IMDS, you can bind the secondary IPv4 addresses temporarily using iproute2 or permanently via your network manager.

To add the addresses immediately for the current session:

sudo ip addr add 10.0.1.25/24 dev ens5
sudo ip addr add 10.0.1.26/24 dev ens5

To make the configuration persistent on systems using Netplan (such as Ubuntu), create or edit /etc/netplan/60-secondary-ips.yaml:

network:
  version: 2
  ethernets:
    ens5:
      addresses:
        - 10.0.1.25/24
        - 10.0.1.26/24

Apply the Netplan configuration:

sudo netplan apply

Manual Configuration on Windows Server

On Windows Server instances where EC2Launch or EC2Config is not configured to manage secondary IPs automatically, configure the adapter inside the guest OS:

  1. Query the subnet mask and default gateway using ipconfig /all in PowerShell or Command Prompt.
  2. Open Control Panel, navigate to Network and Sharing Center, and click Change adapter settings.
  3. Right-click the active network adapter and select Properties.
  4. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
  5. Select Use the following IP address, enter the primary private IPv4 address, subnet mask, and default gateway, as well as the VPC DNS server address.
  6. Click Advanced at the bottom of the dialog box.
  7. Under the IP addresses section in the IP Settings tab, click Add and enter each secondary private IPv4 address along with the subnet mask.
  8. Click OK on all dialog boxes to apply the settings.

Alternatively, you can add secondary IPv4 addresses via PowerShell once the interface is set to static addressing:

New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.0.1.25 -PrefixLength 24
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.0.1.26 -PrefixLength 24

Unassigning Secondary Private IPv4 Addresses

If you no longer need a secondary private IPv4 address on an Elastic Network Interface, remove it using the AWS CLI:

aws ec2 unassign-private-ip-addresses \
    --network-interface-id eni-0123456789abcdef0 \
    --private-ip-addresses 10.0.1.25 10.0.1.26

If you manually configured the addresses inside the operating system, remove them from your OS network configuration files prior to or immediately after unassigning them from the ENI to avoid routing issues.