ENI Finder

Unattached Network Interface Finder

The ENI Finder is a Trigger automation that identifies Elastic Network Interfaces (ENIs) that are not attached to any instance or service. Unattached ENIs can incur unnecessary costs and clutter your VPC.

How It Works

graph LR
    A[ENI Finder] --> B[List All ENIs]
    B --> C[Check Status]
    C --> D{Available?}
    D -->|Yes| E[Flag as Unattached]
    D -->|No| F[Skip]
    E --> G[Generate Report]

1. Enumerate - Lists all network interfaces across configured accounts and regions
2. Filter - Identifies ENIs with status “available” (not attached)
3. Analyze - Gathers details about each unattached ENI
4. Report - Generates a report of findings

Why Unattached ENIs Matter

Cost Impact

Running the Automation

1. Navigate to Automations
2. Find Unattached Network Interface Finder
3. Click Trigger
4. Wait for completion
5. View results in Automation Reports

Prerequisites

The SkySaver IAM role needs:

- Effect: "Allow"
  Action:
    - "ec2:DescribeNetworkInterfaces"
    - "ec2:DescribeAddresses"
  Resource: "*"

Understanding the Report

What to Do with Unattached ENIs

Review Before Action

Check if the ENI is:

• Managed by AWS - Lambda, ECS, EKS create ENIs automatically
• Reserved - Intentionally created for future use
• Orphaned - Left behind after resource deletion

Common Cleanup Actions

1. Delete the ENI (if truly orphaned):

   aws ec2 delete-network-interface --network-interface-id eni-xxxxxxxxx

2. Release associated EIP (if any):

   aws ec2 release-address --allocation-id eipalloc-xxxxxxxxx

ENIs Created by AWS Services

Some ENIs are created and managed by AWS services:

Check the Description and RequesterManaged fields to identify service-managed ENIs.

Best Practices

1. Run monthly - Regular cleanup prevents accumulation
2. Check EIP association - Prioritize ENIs with attached EIPs (cost)
3. Verify requester - Don’t delete service-managed ENIs
4. Document exceptions - Tag ENIs that should be kept
5. Review before deletion - Confirm ENI is truly unused

Filtering Results

When reviewing the report, focus on:

1. ENIs with Elastic IPs - These cost money
2. Non-requester-managed - Manually created ENIs
3. Old ENIs - Created long ago and likely forgotten
4. Empty descriptions - May have been created accidentally

Downloading Results

1. Navigate to Automation Reports
2. Find the ENI Finder execution
3. Click Download CSV
4. Open in spreadsheet for analysis

Troubleshooting

Related Topics

• Automation Reports - View execution history
• Security Group Finder - Related cleanup automation
• AWS Account Setup - IAM permissions