Skip to content
PuglieseWeb Engineering HandbookSystemDox Pages

Elastic Network Interface (ENI)

An Elastic Network Interface (ENI) is a virtual network card in a VPC. Every EC2 instance has at least one; the interface, not the instance, is what the network sees.

Characteristics

Section titled “Characteristics”
  1. Virtual network card. An ENI presents to the operating system as a normal network adapter.
  2. Subnet association. Each ENI belongs to one subnet, and therefore to one Availability Zone. It cannot be attached to an instance in a different zone.
  3. Multiple interfaces. An instance can carry several ENIs; how many depends on the instance type.
  4. Attributes. An ENI can hold a primary private IPv4 address, secondary private IPv4 addresses, one Elastic IP address per private IPv4 address, a public IPv4 address, one or more IPv6 addresses, one or more security groups, and a MAC address.
  5. Independent lifecycle. ENIs can be created without an instance and outlive any instance they were attached to.
  6. Hot attach and detach. A secondary ENI can be attached to or detached from a running instance.
  7. Stable MAC address. The MAC address travels with the ENI, including when it moves to another instance — useful for software licensed to a MAC address.

Security groups attach to network interfaces, not to instances. An instance with two ENIs can therefore sit behind two different security policies at the same time.

When a second interface earns its place

Section titled “When a second interface earns its place”
  • A management path. A separate ENI on a management subnet keeps administrative access off the production path.
  • Network and security appliances. Inline appliances usually need distinct inbound and outbound interfaces.
  • Dual-homed instances. One interface on a public subnet, another on a private subnet reaching a database tier.
  • Low-cost failover. Moving an ENI — with its private address and any Elastic IP — from a failed instance to a standby redirects traffic without a DNS change.
  • Applications that need several addresses, for example multiple TLS certificates bound to distinct IPs.
Section titled “Related pages”