Attach and detach ENIs using the AWS Management Console, AWS CLI, or AWS SDKs, with the ability to attach ENIs to running or stopped EC2 instances depending on the instance type and the ENI being primary or secondary.

You can attach additional ENIs to an EC2 instance during launch or while the instance is running (hot attach) for supported instance types. The primary ENI (eth0) is attached at launch and cannot be detached. Secondary ENIs can be attached to running instances of most current-generation instance types, or to stopped instances for all instance types. Detaching an ENI removes it from the instance but preserves the ENI configuration, allowing you to attach it to another instance later.

AWS CLI: Attach an ENI

AWS CLI: Detach an ENI

AWS Management Console: Attach/Detach ENI

Attachment Rules and Limitations

1
The primary network interface (eth0) cannot be detached from an instance
2
You cannot attach an ENI to an instance in a different Availability Zone
3
An ENI can only be attached to one instance at a time
4
Some older instance types require the instance to be stopped before attaching/detaching ENIs
5
Nitro-based instances support hot attach/detach of ENIs while the instance is running
6
An instance can have multiple ENIs, but the maximum number varies by instance type (from 2 to 15+ secondary ENIs)
7
When attaching an ENI, the device index must be unique and sequential
8
After attaching, you may need to configure the OS to recognize the new network interface (e.g., using dhclient or creating network config files)

When you attach a secondary ENI to a running instance, the operating system may not automatically detect and configure the new interface. For Linux instances, you typically need to run sudo dhclient ethN (where N is the device index) or configure the interface permanently in /etc/network/interfaces or /etc/sysconfig/network-scripts/. For Windows instances, the new interface should be detected automatically, but you may need to enable it in the Network Connections control panel.

Difficulty: 6/10

Topics: ENI attachment lifecycle, network interface persistence, multi-ENI use cases

Scenario Questions

0-2 years experience

1
You need to move a network interface from one EC2 instance to another to test a network configuration. What steps do you take, and what state must the source instance be in?
2
You attached a secondary ENI to a running instance, but the OS doesn’t show the new interface. What’s the first thing you check?

2-5 years experience

1
A microservice pod on an EC2 instance lost network connectivity after a deployment. The logs show the ENI was detached and reattached during a scaling event — what could have gone wrong, and how would you fix it?
2
Your team uses multiple ENIs to isolate traffic types (e.g., public vs private). One instance suddenly can’t reach its database — you notice the ENI assigned to the private subnet is missing. How do you troubleshoot this?

5-8 years experience

1
You’re designing a high-throughput data ingestion service that needs to handle 10K+ concurrent connections. How would you use multiple ENIs to scale network performance, and what limits or bottlenecks should you monitor?
2
Your application uses ENI mobility for zero-downtime deployments, but you’ve noticed intermittent packet loss during ENI swaps. What are the possible root causes, and how would you mitigate them?

8+ years experience

1
You’re migrating a legacy monolith from single-ENI to multi-ENI architecture across hundreds of instances. What are the operational risks, and how would you design a phased rollout with rollback safety?
2
Your organization uses ENI attachment/detachment for dynamic network segmentation in a multi-tenant environment. How do you prevent cross-tenant ENI hijacking or misconfiguration at scale, and what governance controls would you enforce?

Follow-up Questions

❓What happens if you try to detach the primary ENI while the instance is running?
❓How would you automate ENI reattachment after a failure without manual intervention?
❓Why might you choose a secondary ENI over assigning multiple IPs to the primary one?