ENI Finder

Unattached Network Interface Finder

The Unattached Network Interface Finder is a Trigger automation that scans your AWS accounts for Elastic Network Interfaces (ENIs) with status available — meaning they are not attached to any instance or service. It reports findings only; it does not delete or modify any resources.

How It Works

graph LR
    A[Run Now] --> B[Scan All Accounts]
    B --> C[Scan Each Region]
    C --> D[Find Available ENIs]
    D --> E[Record Findings]
    E --> F[Generate Report]
  1. Trigger - User clicks Run Now to start the automation
  2. Scan accounts - For each configured AWS account, assumes the cross-account IAM role
  3. Scan regions - Checks each configured region for ENIs with status available
  4. Filter - Skips AWS-managed ENIs (e.g. Lambda, ECS, EKS, RDS) and any ENIs tagged with SkySaverIgnore=UnattachedENI
  5. Record - Logs each unattached ENI as a finding in the report

No changes are made to your AWS resources — this automation is read-only.

Running the Automation

  1. Navigate to Automations
  2. Find Unattached Network Interface Finder
  3. Click Run Now
  4. Wait for completion (time varies with number of accounts and regions)
  5. View results in Automation Reports

Opting Out an ENI

To exclude a specific ENI from the report, add the following tag to it in AWS:

  • Key: SkySaverIgnore
  • Value: UnattachedENI

What Gets Scanned

The automation scans all regions configured for each account. If no regions are configured, it defaults to scanning:

us-east-1, us-east-2, us-west-1, us-west-2, eu-west-1, eu-west-2, eu-west-3, eu-central-1, ap-southeast-1, ap-southeast-2, ap-northeast-1

Understanding the Report

Each row in the Automation Report represents one unattached ENI:

FieldDescription
ENI IDNetwork interface ID (eni-xxx)
AccountAWS account ID
RegionAWS region where the ENI exists
VPC IDVPC containing the ENI
Subnet IDSubnet where the ENI resides
Private IPPrimary private IP address
DescriptionENI description (often indicates the creating service)
Interface TypeType of interface (e.g., interface, vpc_endpoint)
Availability ZoneAZ where the ENI resides

Why Unattached ENIs Matter

IssueImpact
Elastic IPsUnattached ENIs with associated Elastic IPs incur hourly charges (~$3.60/month per EIP)
ENI limitsCount against your per-region ENI quota
SecurityUnused ENIs may retain outdated security group rules
ClutterMake network management and auditing harder

Cleaning Up Unattached ENIs

After reviewing the report in AWS Console:

  1. Delete the ENI (if confirmed orphaned):

    aws ec2 delete-network-interface --network-interface-id eni-xxxxxxxxx

  2. Release an associated Elastic IP (if any — do this before deleting the ENI):

    aws ec2 release-address --allocation-id eipalloc-xxxxxxxxx

Prerequisites

The SkySaver IAM role in each target account needs:

  • ec2:DescribeNetworkInterfaces

Troubleshooting

IssueLikely CauseSolution
No ENIs foundNo unattached ENIs exist, or permissions issueVerify IAM role has ec2:DescribeNetworkInterfaces
Expected ENI missingENI has SkySaverIgnore=UnattachedENI tagRemove the tag if you want it included
Missing regionsRegions not configured for the accountUpdate regions in Tenant Management or project defaults
Expected ENI not in reportIt is AWS-managed (RequesterManaged=True)This is correct — AWS-managed ENIs are automatically excluded