Security Groups, ENIs and Elastic IPs

Inside a VPC, three small building blocks decide how one instance appears on the network. The elastic network interface (ENI) is the virtual network card. The security group is the firewall attached to that card. The Elastic IP is a fixed public address you can map to it. This note covers each one and the mistakes people make with them, building on the subnets and route tables from VPC: Subnets, Route Tables and Gateways.

Elastic network interfaces#

Start with the card, since the other two attach to it. An ENI is a virtual network interface in a VPC, and every instance has at least one. The ENI, not the instance, holds the network identity.

What an ENI carries#

That identity is a bundle of attributes. Most are optional, and the table lists them all.

How ENIs behave#

Because the identity lives on the ENI, what happens when you move an ENI decides most of its behavior.

• Each instance has a primary ENI (eth0). You cannot detach it.
• You can create secondary ENIs and attach, detach and reattach them. The maximum number per instance depends on the instance type.
• When you move a secondary ENI to another instance, its private IPs, Elastic IPs and security groups move with it. Traffic to those addresses now reaches the new instance. This is a simple way to fail over a fixed address.
• An ENI lives in one subnet, so in one AZ and one VPC. You can attach it only to an instance in the same AZ.
• AWS does not move ENIs for you. Failover needs a script or automation.
• Extra ENIs do not add bandwidth. The instance type sets the network bandwidth limit.
• The number of private IPs an ENI can hold depends on the instance type, and the subnet must have free addresses.

One attribute from the table needs more explanation. The source/destination check drops traffic where the instance is neither the source nor the destination. A NAT instance or a software router forwards other machines' traffic, so it needs this check turned off.

Security groups#

A security group is the firewall on the card: a virtual firewall attached to an ENI. When people say "the instance's security group", they mean the groups on its ENIs. Every ENI has at least one security group. If you do not pick one at launch, AWS uses the VPC's default group.

How rules work#

• Allow rules only. There is no deny rule. Anything not allowed is dropped.
• Each rule names a protocol, a port range and a source (inbound) or destination (outbound).
• A source can be a CIDR block or another security group. "Allow port 5432 from sg-app" lets any instance in the app group reach the database, whatever its IP.
• A new security group allows all outbound traffic and no inbound traffic.
• The VPC's default security group allows inbound traffic from members of the same group, and all outbound.
• AWS evaluates every rule from every attached group together. If any rule allows the packet, it passes. There is no rule order or priority.
• Rule changes apply at once to every attached ENI. No restart.
• Default quotas limit the number of groups per ENI and rules per group.

Stateful#

Security groups are stateful. If a rule lets a request in, the response goes out automatically, even with no outbound rule for it. The same is true in the other direction: if an outbound rule lets a request out, its reply comes back in.

Here is a web server security group that puts those rules together:

The same group as a CLI call, adding the HTTPS rule:

aws ec2 authorize-security-group-ingress \
  --group-id sg-0123456789abcdef0 \
  --protocol tcp --port 443 \
  --source-group sg-0fedcba9876543210

What security groups do not do#

• They do not log which rule allowed a packet. Use VPC Flow Logs to see accepted and rejected traffic.
• They belong to one VPC. You cannot attach a group to an instance in another VPC.
• Some managed services, such as S3 and DynamoDB, do not use security groups. You control access to them with IAM policies, bucket policies and VPC endpoints.

Network ACLs: the stateless contrast#

Security groups are easiest to understand next to the other VPC firewall, which works the opposite way. A network ACL (NACL) is a second, optional firewall at the subnet boundary. It filters all traffic that enters or leaves the subnet.

Because a NACL is stateless, a reply is a separate packet that needs its own allow rule. Replies come back to an ephemeral port on the client (a high-numbered port such as 1024 to 65535). If you allow inbound 443 but forget outbound ephemeral ports, requests arrive and replies are dropped.

The default NACL allows all traffic both ways. Most teams leave it like that and do their filtering in security groups. Use NACL deny rules for coarse blocks, such as blocking a known bad address range for a whole subnet. The two layers work on their own: a packet must pass both.

Elastic IP addresses#

The last building block is the address the outside world uses. By default, an instance's public IPv4 address comes from a pool and is not yours to keep. It changes when you stop and start the instance, and it is released when you terminate the instance. A reboot keeps it.

An Elastic IP (EIP) is a static public IPv4 address that you allocate to your account. It stays yours until you release it.

• You map an EIP to a private IPv4 address on an ENI. Each private IPv4 can have one EIP, so an ENI with several private IPs can hold several EIPs.
• Associating an EIP replaces the instance's auto-assigned public IP. That old address is released, and you cannot get it back. Connections to the old address drop.
• You can move an EIP to another instance or ENI at any time. Clients keep the same address, which is useful for quick failover.
• When you disassociate an EIP, it stays allocated to your account. The instance gets a new auto-assigned public IP only if its subnet is set to assign one (default subnets are; custom subnets usually are not).
• AWS charges for public IPv4 addresses, including EIPs, both in use and idle. Release EIPs you no longer need.
• EIPs are IPv4 only. IPv6 addresses in a VPC are already globally unique and stay with the ENI, so they need no Elastic equivalent.

Use EIPs sparingly. A load balancer's DNS name is usually a better stable entry point than a fixed address on one instance.

Key takeaways#

• An ENI holds the network identity: IPs, MAC address and security groups. Moving a secondary ENI moves all of it.
• Security groups attach to ENIs, allow only, and are stateful. Reference other security groups instead of IP ranges where you can.
• Network ACLs work at the subnet level, are stateless and support deny rules. Remember the ephemeral ports for return traffic.
• A default public IPv4 changes on stop and start. An Elastic IP stays fixed until you release it.
• You can have one Elastic IP per private IPv4 address, not one per ENI. Elastic IPs are IPv4 only, and AWS charges for public IPv4.