In the console this resource is simply called a network interface. Docs often say ENI for short.
Why it matters
In Simple Words
What problem does it solve?
Networking details (IPs, MAC, firewall rules) need a home. The ENI is that home, so you can move some of those settings with a secondary interface or remap an Elastic IP without rebuilding the whole instance.
Primary vs secondary
Every instance has a primary ENI you cannot detach. Secondary ENIs are optional extras in the same Availability Zone for advanced setups.
When should a beginner look at ENIs?
After launch and Elastic IP association, when you want to see where the public IP actually attaches—or before you release unused Elastic IPs.
Changing groups on the ENI changes what traffic can reach that interface.
Multiple groups combine as allow lists.
Avoid these
Common Beginner Mistakes
Trying to detach the primary ENI
Only secondary interfaces can be detached and moved.
Wrong Availability Zone
Secondary ENIs must stay in the same AZ as the instance.
Ignoring idle Elastic IPs
An EIP on a detached/unused association can still bill—release when done.
Editing security groups on the wrong ENI
Multi-ENI instances can have different groups per interface.
Remember
Key Takeaways
ENI = virtual NIC holding IPs and security groups.
Primary ENI is permanent for the instance lifetime.
Elastic IPs bind to private IPs on an ENI.
One line: find the instance’s ENI to understand IPs, Elastic IP attachment, and security groups.
Frequently Asked Questions
A network interface (ENI) is a virtual network card in your VPC that holds private IPs, optional public or Elastic IPs, a MAC address, and security groups, and can attach to an EC2 instance in the same Availability Zone.
Every EC2 instance gets a primary ENI at launch. You cannot detach that primary interface from the instance.
An Elastic IP associates to a private IPv4 address on a network interface. Associating an EIP to an instance usually means attaching it to that instance’s ENI.
You can detach a secondary ENI and attach it to another instance in the same Availability Zone. The primary ENI stays with its instance.
Security groups attach to network interfaces. Traffic to the instance is filtered by the groups on its ENIs.
Usually no. Learn the primary ENI, Elastic IP association, and security groups first. Add secondary interfaces later for multi-homing or advanced networking.
