EC2 instance has no more than one Elastic Network Interface (ENI) attached
ec2_instance_uses_single_eni
EC2 instances are evaluated for attached network adapters. It identifies instances with more than one ENI-including efa, interface, or trunk types-and distinguishes those using a single adapter.
Risk
Multiple ENIs create dual-homed hosts across subnets and security groups, enabling unintended routing and policy bypass. Adversaries can pivot between segments, use alternate egress for data exfiltration, or exploit asymmetric paths, undermining segmentation and confidentiality/integrity while complicating containment.
prowler aws --checks ec2_instance_uses_single_eni
Recommendation
Prefer a single ENI per instance.
If multi-homing is unavoidable:
- Place ENIs in least-privilege subnets/SGs
- Keep
source/destination checkenabled and routes explicit - Use gateways/LBs for NAT or ingress, not the host
- Monitor flow logs and formally approve exceptions
Embed defense in depth and zero trust.
Remediation
aws ec2 detach-network-interface --attachment-id <ATTACHMENT_ID>
- Open the AWS EC2 console and go to Network Interfaces
- Filter by the affected instance ID
- Select each non-primary network interface (Primary cannot be detached)
- Choose Actions > Detach
- Confirm the detach for each secondary ENI
Source Code
Resource Type
AwsEc2Instance