Elastic Network Interfaces: ENI Limits, awsvpc Mode, and Trunk ENIs

What an ENI is

An Elastic Network Interface (ENI) is a virtual network card attached to an EC2 instance. Every instance has a primary ENI (eth0) created at launch. Additional ENIs can be attached to the same instance, each with:

• A private IPv4 address from the subnet
• Optional Elastic IP (public IPv4)
• Security group assignments (per-ENI, not per-instance)
• A MAC address

ENIs are independent resources — you can detach a secondary ENI from one instance and attach it to another. The private IP and security groups move with it.

ENI limits by instance type

# Check ENI limits for a specific instance type
aws ec2 describe-instance-types \
  --instance-types m5.xlarge \
  --query "InstanceTypes[].NetworkInfo.{MaxENIs:MaximumNetworkInterfaces,MaxIPs:Ipv4AddressesPerInterface}"

Common limits:

| Instance type | Max ENIs | IPs per ENI | Max private IPs | |---|---|---|---| | t3.micro | 3 | 2 | 6 | | t3.large | 3 | 12 | 36 | | m5.xlarge | 4 | 15 | 60 | | m5.4xlarge | 8 | 30 | 240 | | c5.18xlarge | 15 | 50 | 750 |

For ECS in awsvpc mode: available task slots = Max ENIs - 1 (primary ENI). An m5.xlarge supports 3 simultaneous ECS tasks with awsvpc networking.

awsvpc mode: task-level network isolation

awsvpc mode gives each ECS task its own ENI. Tasks are VPC-first-class — they have their own IP addresses, security groups, and appear directly in VPC flow logs.

Without awsvpc (bridge mode): tasks share the host's ENI, and security groups are applied at the host level. All tasks on the same host share the same security group rules.

With awsvpc:

resource "aws_ecs_task_definition" "app" {
  family                   = "app"
  network_mode             = "awsvpc"   # each task gets its own ENI
  requires_compatibilities = ["FARGATE"]
  cpu                      = 256
  memory                   = 512

  container_definitions = jsonencode([{
    name  = "app"
    image = "nginx:latest"
    portMappings = [{
      containerPort = 80
      protocol      = "tcp"
    }]
  }])
}

resource "aws_ecs_service" "app" {
  name            = "app"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.app.arn
  desired_count   = 3

  network_configuration {
    subnets          = var.private_subnet_ids
    security_groups  = [aws_security_group.app_task.id]
    assign_public_ip = false
  }
}

Each task gets a distinct security group (aws_security_group.app_task). This enables security group rules that target specific tasks rather than all tasks on a host.

# Enable awsvpcTrunking on an account (opt-in, per-region)
aws ec2 modify-account-attribute \
  --attribute awsvpcTrunking \
  --attribute-value true

Secondary ENIs: multi-homed instances and appliance patterns

Secondary ENIs enable a single instance to have network interfaces in different subnets. Common patterns:

Network appliances: a firewall or NAT instance with one ENI facing the public subnet and one ENI facing the private subnet. Traffic flows through the instance between subnets.

Management networks: one ENI for application traffic, a second ENI on a restricted management subnet for monitoring and SSH. Security groups differ per ENI.

# Attach a secondary ENI to an existing instance
resource "aws_network_interface" "secondary" {
  subnet_id       = var.management_subnet_id
  security_groups = [aws_security_group.management.id]

  attachment {
    instance     = aws_instance.app.id
    device_index = 1  # eth1, primary is device_index 0
  }
}

ENI failover: detach a secondary ENI (carrying an Elastic IP) from a failed instance and attach it to a standby instance. The IP moves within seconds — faster than DNS-based failover.

# Detach ENI from failed instance
aws ec2 detach-network-interface \
  --attachment-id eni-attach-abc123 \
  --force

# Attach to standby instance
aws ec2 attach-network-interface \
  --network-interface-id eni-0abc123 \
  --instance-id i-0xyz456 \
  --device-index 1