All checks
Low
EC2 instances should not use multiple ENIs
Flags an EC2 instance with more than one network interface attached, EFAs included. A second interface usually puts the instance in two subnets, a path between them that no route table or security group describes. EKS nodes, whose VPC CNI adds interfaces for pod addresses, and HPC instances using EFAs fail by design; suppress those rather than detach.
- service
- EC2
- severity
- Low
- scope
- evaluated in every region
How to fix it
- Can break clients: Traffic to a detached interface's addresses stops at once, so move any listener, route or DNS record that uses them first.
- Affects another check: An Elastic IP address on a detached interface stays with that interface, so EC2.12 fails it until you move or release it.
In the console
EC2 → Instances → the instance → Actions → Networking → Detach network interface
- Network interface
- Each secondary interface in turn; the primary one cannot be detached
With the AWS CLI
aws ec2 detach-network-interface --attachment-id <eni-attachment-id> --region <region>See which of your accounts this check is failing on.
Book a live scan