What Is an AWS Elastic Network Interface (ENI) for EC2?

An Elastic Network Interface (ENI) is a logical networking component in a Virtual Private Cloud (VPC) that acts as a virtual network interface card (NIC) for Amazon Elastic Compute Cloud (EC2) instances. This article explores the core architecture of an ENI, the networking attributes it encapsulates, how it attaches to and detaches from compute instances, and common deployment scenarios such as high-availability failover and network traffic segregation.

Core Components and Attributes of an ENI

Just as a physical server relies on a hardware network interface card to connect to a local area network, an Amazon EC2 instance relies on an ENI to communicate within a VPC and with external networks. An ENI is an independent AWS resource that exists within a specific subnet and Availability Zone. Because its configuration is tied to the ENI resource rather than the EC2 instance itself, all networking attributes stay with the interface even when it is moved between instances.

An Elastic Network Interface can hold the following attributes:

  • Primary Private IPv4 Address: Every ENI is assigned one primary private IPv4 address from the IPv4 CIDR block range of its subnet. This address cannot be changed after the ENI is created.
  • Secondary Private IPv4 Addresses: Depending on the EC2 instance type, an ENI can hold one or more secondary private IPv4 addresses from the same subnet range.
  • Elastic IP or Public IPv4 Addresses: Each private IPv4 address associated with an ENI can be mapped to an Elastic IP (EIP) or an auto-assigned public IPv4 address via network address translation at the Internet Gateway.
  • IPv6 Addresses: If the VPC and subnet support IPv6, one or more global unicast IPv6 addresses can be assigned to the interface.
  • MAC Address: Every ENI has a unique Media Access Control (MAC) address used for Layer 2 Ethernet frame delivery within the VPC network fabric.
  • Security Groups: Firewall rules in AWS are applied directly to the ENI rather than to the instance OS. Multiple security groups can be associated with a single ENI to govern inbound and outbound traffic.
  • Source/Destination Check Flag: By default, an ENI verifies that it is either the source or the destination of any traffic it handles. Disabling this check allows an EC2 instance to act as a network address translation (NAT) device, router, or firewall appliance.

Primary vs. Secondary Network Interfaces

Every EC2 instance starts with a default network interface known as the primary ENI, commonly seen inside a Linux operating system as eth0 or ens5. The primary ENI is created automatically when the instance launches, resides in the subnet selected for the instance, and cannot be detached from the instance while it exists. When the EC2 instance is terminated, the primary ENI is deleted automatically by default.

Beyond the primary interface, you can create secondary ENIs and attach them to running or stopped EC2 instances. Secondary ENIs share the same Availability Zone as the instance, though they can belong to different subnets within that Availability Zone. Unlike the primary interface, secondary ENIs can be detached from one instance and reattached to another without restarting the instances, allowing rapid redirection of network traffic.

How ENIs Function on the AWS Hypervisor

Under the hood, AWS uses the Nitro System to offload virtualization of networking, storage, and management onto dedicated hardware. When you attach an ENI to a Nitro-based EC2 instance, the Nitro Card presents the ENI to the guest operating system as a standard PCIe device using the Elastic Network Adapter (ENA) driver.

When packets leave the guest operating system through the virtual interface, the Nitro hardware encapsulates and processes the traffic according to VPC routing tables and security group state tables before placing it onto the physical AWS network fabric. If you detach a secondary ENI from Instance A and attach it to Instance B, the AWS control plane updates its mapping tables so that packets destined for the ENI's IP or MAC address are immediately routed to the Nitro hardware hosting Instance B.

Capacity Limits and Scaling Formulas

The maximum number of ENIs you can attach to an EC2 instance, as well as the maximum number of private IP addresses supported per ENI, depends on the instance family and size. Larger instance sizes provide higher networking allocations.

If an instance type supports up to \(N\) network interfaces and each interface supports up to \(M\) private IPv4 addresses, the total number of private IPv4 addresses \(T_{\text{IPv4}}\) that a single EC2 instance can host across all of its interfaces is expressed as:

\[T_{\text{IPv4}} = N \times M\]

Within a single ENI supporting \(M\) total IPv4 addresses, the number of available secondary private IPv4 addresses \(S_{\text{IPv4}}\) is:

\[S_{\text{IPv4}} = M - 1\]

For example, if an instance supports \(N = 4\) interfaces and \(M = 15\) private IPv4 addresses per interface, the instance can manage up to \(T_{\text{IPv4}} = 60\) private IPv4 addresses, with each ENI holding \(1\) primary address and up to \(14\) secondary addresses.

Common Use Cases for Elastic Network Interfaces

High-Availability Failover

Because secondary ENIs retain their IP addresses, MAC addresses, and security groups when moved, they provide a fast mechanism for active-standby failover. If a primary database or virtual appliance fails health checks, an automation script or cluster manager can call the EC2 API to detach the secondary ENI from the unhealthy instance and attach it to a standby instance in the same Availability Zone. Client applications continue communicating with the exact same private IP address without waiting for DNS propagation.

Management and Data Plane Segregation

Organizations with strict compliance requirements often separate production application traffic from administrative and monitoring traffic. By attaching two ENIs located in different subnets to a single EC2 instance, an administrator can configure the primary ENI in a public or application subnet to serve customer traffic with one set of security groups, while placing the secondary ENI in an isolated management subnet restricted to SSH, RDP, or logging traffic with a different set of security groups.

Virtual Network Appliances

Load balancers, intrusion detection systems, VPN concentrators, and next-generation firewalls deployed from the AWS Marketplace frequently use multiple ENIs. One interface acts as the untrusted external ingress port, another acts as the internal trusted egress port, and a third serves as an out-of-band management interface.

Container Networking in Amazon EKS

Amazon Elastic Kubernetes Service (EKS) relies heavily on ENIs through the Amazon VPC CNI plugin. The plugin attaches secondary ENIs and assigns secondary private IPv4 addresses directly to Kubernetes Pods running on an EC2 worker node, allowing Pods to have first-class VPC IP addresses and communicate directly with other AWS services without overlay network encapsulation.