Description:

The AWS ENI (AWS Elastic Network Interface) is a virtual network card that can be attached to any instance of the Amazon Elastic Compute Cloud (EC2). The purpose of these devices is to enable network connectivity for your instances. An elastic network interface is a logical networking component in a VPC that represents a virtual network card. Every network interface has a security group, which may be the default or a new security group.

Rationale:

A security group acts as a virtual firewall, controlling the traffic that is allowed to reach and leave the resources that it is associated with.

Impact:

A security group is attached to an ENI; with this approach, we can have multiple routes to the same EC2 instance with different security configurations.

Default value:

By default, security groups are not attached to network interfaces.

Pre-Requisite:

  • Security group

Remediation:

Test Plan:

  • AWS Console Process

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. In the navigation pane, choose Security groups. 

  3. Click on a security group you want to verity if it connected to ENI (Elastic Network Interface).
  4. Copy the security group ID.
  5. Now in the navigation pane, choose Network Interfaces.
  6. In the search pane, select security group IDs filter and paste the security group ID.  

  7. Results will show if the security group is attached to Network Interface. 



Using AWS CLI:


aws ec2 describe-network-interfaces --filters group-id <value>

Implementation Plan:

  • AWS Console Process

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. In the navigation pane, choose Network Interfaces. 

  3. Choose Create network interface.
  4. (Optional) For Description, enter a descriptive name.
  5. For Security groups, select desired security groups.  

  6. (Optional) For each tag, choose Add new tag and enter a tag key and an optional tag value.

  7. Choose Create network interface. 


Using AWS CLI:

This example creates a network interface for the specified subnet. 

aws ec2 create-network-interface --subnet-id subnet-9d4a7b6c --description "my network interface" --groups sg-903004f8 --private-ip-address 10.0.2.17

Backout plan:

  • AWS Console Process

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. In the navigation pane, choose Network Interfaces. 

  3. Select the desired network interface and click on actions
  4. Select delete.


Using AWS CLI:

This example deletes the specified network interface. If the command succeeds, no output is returned.