Multiple ENIs Should Not Be Attached To EC2 Instances

Using Console

To remediate the issue of an EC2 instance using multiple Elastic Network Interfaces (ENIs) in AWS, you can follow these steps using the AWS Management Console:

Identify the EC2 Instance:
- Log in to your AWS Management Console.
- Go to the EC2 dashboard.
- Identify the EC2 instance that is using multiple ENIs.
Detach Unnecessary ENIs:
- Select the EC2 instance that is using multiple ENIs.
- In the Description tab, under Network interfaces, you will see the list of attached ENIs.
- Identify the additional ENIs that are not required for the instance.
- Select the unnecessary ENIs one by one and click on the “Actions” dropdown.
- From the dropdown, select “Detach network interface”.
- Confirm the action to detach the ENI from the EC2 instance.
Delete Unnecessary ENIs (Optional):
- If the ENIs are no longer needed in your account, you can also choose to delete them.
- Go to the EC2 dashboard and select “Network Interfaces” from the left-hand menu.
- Identify the unnecessary ENIs and select them.
- Click on the “Actions” dropdown and choose “Delete network interface”.
- Confirm the action to delete the ENI.
Verify Configuration:
- After detaching or deleting the unnecessary ENIs, go back to the EC2 instance Description tab.
- Ensure that the EC2 instance is now using only the required ENI.
Update Security Groups and Route Tables (if necessary):
- If the ENIs that were detached had specific security group rules or were associated with custom route tables, make sure to update the security groups and route tables associated with the remaining ENI to ensure connectivity and proper network routing.

By following these steps, you should be able to remediate the issue of an EC2 instance using multiple Elastic Network Interfaces in AWS and ensure that it is using only the necessary ENIs.

Using CLI

To remediate the issue of an EC2 instance using multiple Elastic Network Interfaces (ENIs) in AWS using the AWS CLI, you can follow these steps:Step 1: List all the instances with multiple ENIs

aws ec2 describe-instances --query 'Reservations[*].Instances[?length(NetworkInterfaces) > `1`].[InstanceId,NetworkInterfaces[*].NetworkInterfaceId]' --output table

Step 2: Identify the instance you want to work on based on the InstanceId.Step 3: Detach the additional ENIs from the instance

aws ec2 detach-network-interface --attachment-id <AttachmentID>

Replace <AttachmentID> with the attachment ID of the additional ENI you want to detach.Step 4: Verify that the additional ENIs have been detached successfully

aws ec2 describe-instances --instance-ids <InstanceId> --query 'Reservations[*].Instances[*].NetworkInterfaces[*].NetworkInterfaceId' --output table

Replace <InstanceId> with the InstanceId of the instance you worked on.Step 5: If the issue persists, you may need to stop and start the instance for the changes to take effect.

aws ec2 stop-instances --instance-ids <InstanceId>
aws ec2 start-instances --instance-ids <InstanceId>

By following these steps, you can remediate the issue of an EC2 instance using multiple Elastic Network Interfaces in AWS using the AWS CLI.

Using Python

To remediate the issue of an EC2 instance using multiple Elastic Network Interfaces (ENIs) in AWS using Python, you can follow these steps:

Identify the EC2 instances with multiple ENIs: Use the AWS SDK for Python (Boto3) to list all EC2 instances in your account and identify instances with more than one ENI attached.

import boto3

ec2 = boto3.client('ec2')

response = ec2.describe_instances()

for reservation in response['Reservations']:
    for instance in reservation['Instances']:
        if len(instance['NetworkInterfaces']) > 1:
            print(f"Instance {instance['InstanceId']} has multiple ENIs attached.")

Detach extra ENIs: For instances identified with multiple ENIs, you can choose to detach the extra ENIs. Here’s how you can do it:

# Assuming instance_id is the ID of the instance with multiple ENIs
instance_id = 'your_instance_id_here'

response = ec2.describe_instances(InstanceIds=[instance_id])

for interface in response['Reservations'][0]['Instances'][0]['NetworkInterfaces'][1:]:
    interface_id = interface['NetworkInterfaceId']
    ec2.detach_network_interface(
        AttachmentId=interface['Attachment']['AttachmentId'],
        Force=True
    )
    print(f"Detached ENI {interface_id} from instance {instance_id}.")

Verify the remediation: After detaching the extra ENIs, verify that each EC2 instance has only one ENI attached.

response = ec2.describe_instances()

for reservation in response['Reservations']:
    for instance in reservation['Instances']:
        if len(instance['NetworkInterfaces']) > 1:
            print(f"Instance {instance['InstanceId']} still has multiple ENIs attached.")
        else:
            print(f"Instance {instance['InstanceId']} has only one ENI attached.")

By following these steps, you can use Python and Boto3 to identify EC2 instances with multiple ENIs attached and detach the extra ENIs to remediate the misconfiguration.

Using Terraform

# EC2 instance with ONLY the primary network interface attached.
# Remove any extra network_interface blocks so Terraform no longer
# creates or maintains secondary ENIs on this instance.

resource "aws_instance" "example" {
  ami           = "AMI_ID"              # replace with the AMI ID
  instance_type = "INSTANCE_TYPE"       # e.g., t3.micro

  subnet_id              = "SUBNET_ID"  # primary subnet
  vpc_security_group_ids = ["SG_ID"]    # primary SGs

  # If you previously had multiple network_interface blocks here,
  # delete all but the one representing DeviceIndex 0.
}

# If secondary ENIs are attached via aws_network_interface_attachment,
# you must remove/destroy those attachments so the ENIs are detached.
# Example of a secondary attachment to DELETE from your config:

resource "aws_network_interface" "secondary" {
  subnet_id       = "SECONDARY_SUBNET_ID"
  security_groups = ["SECONDARY_SG_ID"]
}

resource "aws_network_interface_attachment" "secondary_to_instance" {
  instance_id          = aws_instance.example.id
  network_interface_id = aws_network_interface.secondary.id
  device_index         = 1              # secondary ENI (must NOT be 0)
}

Detaching a secondary ENI is disruptive: any traffic using that interface’s IPs or security groups will stop, and Terraform will destroy the aws_network_interface_attachment.secondary_to_instance (and the ENI itself if you also remove aws_network_interface.secondary).terraform plan should show the secondary aws_network_interface_attachment (and optionally the secondary aws_network_interface) being destroyed, and no additional network_interface blocks on the aws_instance, leaving only the primary interface (DeviceIndex 0).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Multiple ENIs Should Not Be Attached To EC2 Instances

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: