Amazon EC2

Unused Elastic Network Interfaces

This plugin ensures that unused AWS Elastic Network Interfaces (ENIs) are removed

Risk Level: Low

Description

This plugin ensures that unused AWS Elastic Network Interfaces (ENIs) are removed. Unused AWS ENIs can create unnecessary complexity for your infrastructure. They should be removed to follow best security practices.

About the Service

Amazon EC2: Amazon Elastic Compute Cloud (Amazon EC2) provides scalable computing capacity in the Amazon Web Services (AWS) Cloud. With the EC2 instance, you can launch as many virtual servers as you need, configure security and networking, and manage storage without worrying about the hardware needs of the process. Security Groups act as a firewall for an EC2 instance to control the incoming and outgoing traffic. You can read more about security groups here.

Impact

Unused AWS Elastic Network Interfaces (ENIs) can create complexities in the cloud infrastructure. Moreover, it can add to the service limit and prevent resources from launching. Therefore, it is recommended to remove unused ENIs.

Steps to Reproduce

Using AWS Console-

  1. Log In to your AWS Console.
  2. Open the EC2 Management Console. You can use this link (https://console.aws.amazon.com/ec2) to navigate directly if already logged in. 
  3. Move to the Network Interfaces in the Network & Security section from the left navigation pane.
  4. A list of Network Interfaces in the region will appear. Scroll right to the Status column. If the value is NOT set to “in use”, the vulnerability exists.
  5. Repeat steps for all the Interfaces you want to investigate.

Steps for Remediation

Delete the unused AWS Elastic Network Interfaces:

  1. Log In to your AWS Console.
  2. Open the EC2 Management Console. You can use this link (https://console.aws.amazon.com/ec2) to navigate directly if already logged in. 
  3. Move to the Network Interfaces in the Network & Security section from the left navigation pane.
  4. A list of Network Interfaces in the region will appear. Select the vulnerable network interface by clicking on the checkbox next to it.
  5. From the Actions menu, click on Delete.
  6. Repeat steps for all the vulnerable Interfaces.