EC2 instance has no more than one ENI attached

Check ID: ec2_instance_uses_single_eni
Provider: AWS
Service: ec2
Severity: LOW
Categories: trust-boundaries
Resource type: AwsEc2Instance

What this check verifies

EC2 instances are evaluated for attached network adapters. It identifies instances with more than one ENI-including efa, interface, or trunk types-and distinguishes those using a single adapter.

Risk

Multiple ENIs create dual-homed hosts across subnets and security groups, enabling unintended routing and policy bypass. Adversaries can pivot between segments, use alternate egress for data exfiltration, or exploit asymmetric paths, undermining segmentation and confidentiality/integrity while complicating containment.

Recommendation

Prefer a single ENI per instance. If multi-homing is unavoidable:

Place ENIs in least-privilege subnets/SGs
Keep source/destination check enabled and routes explicit
Use gateways/LBs for NAT or ingress, not the host
Monitor flow logs and formally approve exceptions

Embed defense in depth and zero trust.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 detach-network-interface —attachment-id <ATTACHMENT_ID>

# Terraform: instance with only the primary ENI
resource "aws_instance" "<example_resource_name>" {
  ami           = "<example_resource_id>"
  instance_type = "t3.micro"
  subnet_id     = "<example_resource_id>"  # FIX: only primary ENI; no additional network_interface attachments
}

# CloudFormation: ensure the instance has only one ENI
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: <example_resource_id>
      InstanceType: t3.micro
      SubnetId: <example_resource_id>  # FIX: creates a single primary ENI; do not add extra NetworkInterfaces/attachments

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_instance_uses_single_eni. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires