Create an ENI using the AWS Management Console, AWS CLI, or AWS SDKs by specifying the VPC, subnet, and optionally assigning private IPv4 addresses, Elastic IPs, security groups, and tags.

You can create an Elastic Network Interface (ENI) using the AWS Management Console, AWS CLI, or AWS SDKs. When creating an ENI, you must specify the VPC and subnet in which it will reside. The ENI will receive a primary private IPv4 address from the subnet's IP address range. You can optionally assign secondary private IPv4 addresses, an Elastic IP address (after creation), security groups, and tags.

AWS CLI: Create an ENI

AWS Management Console: Create an ENI

Important Notes on ENI Creation

1
ENIs can be created in a VPC and are specific to a single Availability Zone (the same AZ as the subnet)
2
A primary private IP address is always assigned; you cannot create an ENI without one
3
You can attach an ENI to an EC2 instance only if the instance is in the same Availability Zone as the ENI's subnet
4
After creation, you can attach an Elastic IP address to the primary or secondary private IP addresses
5
ENIs have a default source/destination check enabled; disable it if the instance acts as a network appliance (NAT, router, firewall)

Difficulty: 5/10

Topics: Elastic Network Interface, VPC networking, AWS CLI/SDK

Scenario Questions

0-2 years experience

1
We need to attach a secondary network interface to an EC2 instance for a new microservice. Walk me through the steps you’d take using the AWS console.
2
If you create an ENI in a subnet that doesn't have enough IP addresses, what happens and how would you handle it?
3
How would you verify that the ENI was successfully attached and is functioning as expected?

2-5 years experience

1
Our application requires each instance to have a dedicated ENI with a static private IP and a security group that only allows inbound traffic from a specific CIDR. How would you automate the creation and attachment of these ENIs using CloudFormation or Terraform?
2
During a deployment we noticed that traffic to a service stopped after we added a new ENI. What debugging steps would you take to identify the root cause?
3
Explain the trade‑offs between using a primary ENI versus a secondary ENI for handling high‑throughput traffic.

5-8 years experience

1
Design a solution to manage thousands of ENIs across multiple VPCs for a multi‑tenant SaaS platform, ensuring IP address exhaustion is avoided and cleanup is reliable.
2
How would you handle ENI limits and scaling when launching an auto‑scaling group that needs to attach a unique ENI per instance in each AZ?
3
Discuss the security implications of attaching ENIs with different security groups to the same instance and how you would enforce least‑privilege.

8+ years experience

1
Our organization is migrating from a monolithic network design to a micro‑service architecture that heavily relies on ENIs for service isolation. What architectural changes and governance processes would you put in place to manage ENI lifecycle at scale?
2
If you had to redesign the networking layer to support zero‑downtime deployments using ENI swapping, what patterns would you adopt and what risks would you mitigate?
3
How would you evaluate the cost and operational impact of moving from ENI‑based network segmentation to AWS PrivateLink or a service mesh, and decide which approach to adopt?

Follow-up Questions

❓What would you do if the ENI fails to attach?
❓How do you monitor ENI health and usage?
❓Can you roll back safely if an ENI change causes an outage?