AWS Elastic Network Interface (ENI) Orphaned Allocation Detector
Identify unattached Elastic Network Interfaces (ENIs) in Amazon VPCs that hold unassociated Elastic IPs or prevent subnet/VPC deprecation.
1. Detection Scope & Operational Boundaries
Every ArthaOps detector enforces strict epistemic honesty. We clearly separate what can be mathematically proven via agentless telemetry from what requires contextual human judgement.
What This Detector Identifies
- Elastic Network Interfaces (ENIs) with status == 'available' (unattached to any EC2 instance, Lambda function, NAT Gateway, or Load Balancer) for > 7 days.
- Unattached ENIs associated with public IPv4 Elastic IP addresses incurring universal $0.005/hr IPv4 scarcity surcharges.
- Orphaned ENIs occupying private VPC CIDR IP addresses and blocking subnet deletion or terraform destroy runs.
What It Cannot Establish Alone
- Whether an unattached ENI is designated as a pre-warmed hot-standby interface for high-availability secondary IP failover scripts.
- Whether attached security groups are under active compliance audit review.
2. Telemetry & Evidence Requirements
ArthaOps operates strictly via Plane 1 (Read-Only Discovery). The following CloudFormation / IAM permissions and CloudWatch metrics are evaluated:
AWS::EC2::NetworkInterfaceVerification Protocol: Tested against simulated ENIs with status 'available' and attached public IPv4 associations.
Validation Context: Validated in development and testing VPCs where terminated EC2 spot instances and deleted Lambda VPC attachments left orphaned interfaces.
3. Reproducible AWS CLI Verification Recipe
List all available (unattached) ENIs in ap-south-1 with their associated IPs and VPCs.
# List unattached ENIs in ap-south-1
aws ec2 describe-network-interfaces \
--region ap-south-1 \
--filters "Name=status,Values=available" \
--query "NetworkInterfaces[].{InterfaceId:NetworkInterfaceId,VpcId:VpcId,SubnetId:SubnetId,PublicIp:Association.PublicIp,Description:Description}" \
--output table---------------------------------------------------------------------------------------------------------------------------------------
| DescribeNetworkInterfaces |
+------------------------------------+--------------------------+-----------------------+-----------------------+---------------------+
| Description | InterfaceId | PublicIp | SubnetId | VpcId |
+------------------------------------+--------------------------+-----------------------+-----------------------+---------------------+
| AWS Lambda VPC ENI-abandoned-test | eni-0498a123fbc456789 | 13.235.44.12 | subnet-0123456789abc | vpc-0a1b2c3d4e5f6g |
+------------------------------------+--------------------------+-----------------------+-----------------------+---------------------+💡 ENI 'eni-0498a123fbc456789' is unattached (available) and retains public IP 13.235.44.12, incurring $0.005/hr IPv4 charge.
4. Transparent Economic Model
- Illustrative scenario based on 5 unattached Elastic Network Interfaces holding public IPv4 addresses in ap-south-1.
- 730 operational hours per standard calendar month at universal $0.005/hr IPv4 surcharge (₹84.00/USD).
- ENIs retain an associated public IPv4 address or unassociated Elastic IP.
- Private VPC ENIs without public IPs incur zero direct AWS hourly cost but consume VPC CIDR capacity.
- Standard private VPC ENIs with no public IP do not incur a direct hourly AWS fee (primary cost is CIDR consumption and automation blocks).
5. False-Positive Scenarios & Operational Risks
Never delete or terminate cloud resources blindly. These validated architectural scenarios must be reviewed before initiating remediation:
Documented False-Positive Scenarios
- Warm Standby Failover ENIs: Pre-configured secondary network interfaces ready to attach to an EC2 instance if the primary interface fails.
Blast Radius & Remediation Risks
- Permanent IP Release: Deleting an ENI permanently releases its private IP back to the subnet DHCP pool and dissociates public IPs.
- Mitigation: Verify interface status is 'available' and that no automated orchestration (Kubernetes CNI, Lambda) is actively referencing the ENI.
6. Remediation Procedure & Rollback Runbook
Follow this ordered sequence of verified AWS CLI actions to remediate the resource with complete rollback availability:
Disassociate Elastic IP (if attached)
Disassociate any public IP address before deleting the interface.
aws ec2 disassociate-address --region ap-south-1 --association-id eipassoc-0123456789abcdef0Delete the Orphaned Network Interface
Delete the unattached ENI to free the private IP address.
aws ec2 delete-network-interface --region ap-south-1 --network-interface-id eni-0498a123fbc456789Forensic Rollback Procedure
A deleted ENI cannot be restored with the exact same ENI identifier or MAC address. However, a new ENI with identical security group and subnet attachments can be provisioned in seconds via `aws ec2 create-network-interface`.
🔒 ArthaOps Assurance: ArthaOps strictly filters for ENIs with status == 'available' and confirms zero active attachments before proposing deletion.
Private IP address may be reallocated to another resource by VPC DHCP if not explicitly specified during re-creation.
How This Appears in the ArthaOps Control Plane
Unattached ENI left behind post-Lambda VPC testing retains public IPv4 address 13.235.44.12.
Test Your Infrastructure in 180 Seconds
Explore our zero-setup interactive sample report covering real Mumbai findings, or launch a 100% read-only agentless scan across your AWS environment.