AWS EC2 ENIs and IP Addresses: Private IPs, Elastic IPs, and Failover – SAP-C02 Study Guide

Purpose of This Lesson

Amazon EC2 networking is built around the elastic network interface (ENI). An ENI connects an instance to a VPC and carries its private IPv4 addresses, security groups, MAC address, and optional public or Elastic IP associations.

Understanding how ENIs and IP addresses behave is essential for SAP-C02 scenarios involving instance replacement, failover, persistent public endpoints, multi-homed instances, and network security.

Key Concepts

Elastic Network Interfaces

An ENI is a virtual network card attached to an EC2 instance. A primary ENI is created automatically when an instance launches. You can also create and attach additional ENIs when the instance type supports them.

An ENI is associated with:

• A VPC and subnet
• One Availability Zone
• One or more private IPv4 addresses
• An optional IPv6 address configuration
• One or more security groups
• A virtual MAC address
• Optional public IPv4 or Elastic IP associations

An ENI can be detached from one instance and attached to another, subject to compatibility and Availability Zone requirements. This makes an ENI useful for moving network identity between instances during failover or recovery.

Primary and Secondary Private IPv4 Addresses

Every primary ENI has a primary private IPv4 address. Additional private IPv4 addresses can be assigned to the primary ENI or to secondary ENIs, subject to the limits of the VPC and instance type.

The primary private IPv4 address normally remains assigned when an instance is stopped and started. Private addresses are allocated from the subnet’s CIDR range and are reachable within the VPC according to routing and security controls.

An instance can use multiple private addresses for purposes such as:

• Hosting multiple applications or endpoints
• Supporting network appliances
• Separating management and application traffic
• Running services that require distinct IP identities
• Providing a failover address that can move with an ENI

Automatically Assigned Public IPv4 Addresses

When an instance launches into a subnet configured for public IPv4 assignment, EC2 can associate an automatically assigned public IPv4 address with the instance’s primary private IPv4 address.

Important characteristics:

• The public address is associated with the private address externally by the VPC networking layer.
• The guest operating system normally sees the private address, not the public address.
• The public IPv4 address is not persistent across an EC2 stop/start cycle.
• A new public IPv4 address is generally assigned when the instance starts again.
• The corresponding public DNS hostname can also change when the automatically assigned public address changes.
• Rebooting an instance is different from stopping and starting it; a reboot does not normally release the automatically assigned public IPv4 address.

Applications should not hard-code an automatically assigned public IP address or public DNS hostname when the endpoint must survive instance stop/start operations.

Elastic IP Addresses

An Elastic IP address is a static public IPv4 address allocated to an AWS account in a Region. It can be associated with an EC2 instance or an ENI and can be reassociated to another supported resource.

An Elastic IP is useful when a public endpoint must remain stable while the underlying instance changes. Common uses include:

• Moving a service address to a standby instance
• Preserving an allowlisted source or destination address
• Supporting a manual failover process
• Maintaining a stable address during instance replacement

An Elastic IP is associated with a private IPv4 address on an ENI. Therefore, failover commonly involves moving the Elastic IP association or moving the ENI that owns the relevant private address.

Elastic IPs should not be treated as the default solution for highly available application ingress. For scalable architectures, services such as Elastic Load Balancing, Amazon Route 53, or AWS Global Accelerator may be more appropriate.

AWS charges for public IPv4 addresses, including Elastic IP addresses, under current public IPv4 pricing. Unused allocations can also create unnecessary cost and operational clutter, so release addresses that are no longer required.

ENI Availability Zone Constraint

An ENI is created in a specific subnet, and each subnet belongs to one Availability Zone. An ENI can only be attached to an EC2 instance in the same Availability Zone.

To move an ENI to an instance in another Availability Zone, create a new ENI in that target Availability Zone. An ENI cannot be used directly as a cross-AZ failover mechanism.

Security Groups and ENIs

Security groups are associated with ENIs rather than directly with the operating system interface. The effective inbound and outbound rules for an instance are determined by the security groups attached to its ENIs.

When adding a secondary ENI, choose the appropriate security groups during ENI creation or modify them afterward. This allows different interfaces to have different security policies, although the resulting design should remain easy to understand and operate.

Moving Network Identity

There are two related failover patterns:

1. Move an Elastic IP association to a private address on another ENI or instance.
2. Detach and attach an ENI to another instance in the same Availability Zone.

Moving an ENI preserves the ENI’s private address, security group associations, and MAC identity. Moving only an Elastic IP preserves the public address but does not automatically move all the other properties of the original ENI.

Detachment may require the source instance or interface to be stopped, and asynchronous control-plane operations can temporarily leave an ENI in an in-use state. Force-detach options should be used carefully because they can interrupt active network connections and may risk application inconsistency.

Exam-Relevant Takeaways

• The primary ENI is created with the EC2 instance; additional ENIs can be created and attached separately.
• An ENI belongs to a subnet and therefore to one Availability Zone.
• An ENI can be attached only to an instance in the same Availability Zone.
• A primary private IPv4 address normally persists through stop/start operations.
• An automatically assigned public IPv4 address is released when an instance is stopped and is usually replaced when the instance starts again.
• Reboot and stop/start are different lifecycle operations for public IP behavior.
• Use an Elastic IP when a stable public IPv4 address is required.
• Use an ENI when the failover unit should include the private IP, security groups, and virtual network interface identity.
• Security groups are associated with ENIs and can differ between interfaces.
• An Elastic IP is Regional, but an ENI is tied to an Availability Zone.
• Do not select an Elastic IP merely because it is available; compare it with load balancers, Route 53, Global Accelerator, or private service discovery based on the architecture.
• Release unused public IPv4 and Elastic IP resources to avoid cost and governance problems.

Architecture Decision Guide

Requirement	Preferred mechanism	Reason and caveat
Instance needs ordinary VPC connectivity	Primary ENI with private IP	Automatically created and appropriate for most workloads
Stable public IPv4 for one active instance	Elastic IP	Address can survive instance stop/start and be reassociated
Move private IP and security policy with a service	ENI reassociation	Preserves the interface’s private address and attached security groups
Multiple network identities on one instance	Secondary private IPs or secondary ENIs	Provides separate addresses; verify instance and ENI quotas
Failover across Availability Zones	New ENI in target AZ plus application-level or DNS/load-balancer failover	An ENI cannot be attached across AZs
Highly available public application ingress	Application Load Balancer, Network Load Balancer, Route 53, or Global Accelerator	Usually more scalable and automated than manually moving an Elastic IP
Private service-to-service communication	Private IPs, internal load balancer, or service discovery	Avoids unnecessary public exposure
Preserve a stable endpoint during instance replacement	Elastic IP, DNS abstraction, or load balancer	Select based on scale, automation, health checking, and client behavior

Common Exam Traps

• Confusing reboot with stop/start: A reboot normally preserves an automatically assigned public IPv4 address; stop/start does not.
• Assuming the OS sees the public IP: The guest interface normally reports the private address. Public-to-private translation and association are handled outside the guest operating system.
• Attaching an ENI across AZs: This is not supported. The ENI and target instance must be in the same Availability Zone.
• Using a public IP as a permanent endpoint: Automatically assigned public addresses can change after stop/start.
• Assuming an Elastic IP provides high availability by itself: It provides address persistence, not health checks, automatic failover, scaling, or cross-Region resilience.
• Forgetting security groups are per ENI: Adding a secondary interface does not necessarily give it the same security groups as the primary interface.
• Treating an ENI as Regional: The ENI is AZ-scoped even though the Elastic IP is Regional.
• Ignoring quotas: The number of ENIs and private IP addresses depends on the EC2 instance type and VPC-related quotas.
• Leaving public IPv4 allocations unused: Unused public IPv4 and Elastic IP resources can incur charges and increase the attack surface or governance burden.
• Expecting DNS to be an immutable identifier: EC2-generated public DNS names can change when the underlying automatically assigned public IP changes. Use a controlled DNS name when clients need a stable name.

Real-World Engineer Notes

• Prefer a DNS name, load balancer, or service discovery mechanism over embedding an IP address in application configuration.
• If a manual failover procedure moves an Elastic IP, document the exact association target: an instance or a specific private IPv4 address on an ENI.
• An ENI-based failover pattern is usually AZ-local. For AZ resilience, deploy a standby or replacement network interface in each required AZ and automate the failover process.
• Test detach and attach operations with the actual instance type and operating system. Some workloads depend on interface ordering, routes, or OS-level configuration.
• Plan security groups per interface deliberately. A management ENI and an application ENI may require very different ingress rules.
• Use automation such as AWS Systems Manager, Lambda, Step Functions, or infrastructure-as-code to reduce error-prone manual reassociation steps.
• For production services, compare operational complexity against managed ingress options such as an ALB, NLB, Route 53 health checks, or Global Accelerator.
• Monitor public IPv4 usage and remove obsolete allocations as part of cost and governance reviews.

Quick Reference Summary

• Private IPv4: VPC address assigned to an ENI; normally remains through instance stop/start.
• Automatic public IPv4: Temporary public address associated externally with a private address; typically changes after stop/start.
• Elastic IP: Static public IPv4 address that can be reassociated within its Region.
• Primary ENI: Created with the instance.
• Secondary ENI: Additional virtual network interface that can be attached or detached.
• AZ rule: ENI and instance must be in the same Availability Zone.
• Security group scope: ENI-level.
• Best failover choice: Move an Elastic IP for public address persistence; move an ENI when private address and interface security identity must move together.
• Best scalable ingress choice: Usually a load balancer, DNS-based design, or Global Accelerator rather than manual IP movement.

Flashcards

1. Q: What is the primary networking resource attached to an EC2 instance?

A: An elastic network interface, or ENI.

1. Q: What happens to an automatically assigned public IPv4 address when an instance is stopped?

A: It is released and a different public IPv4 address is generally assigned when the instance starts again.

1. Q: Does an EC2 reboot normally release an automatically assigned public IPv4 address?

A: No. Reboot is not the same as stop/start.

1. Q: What happens to the primary private IPv4 address during stop/start?

A: It normally remains associated with the instance’s primary ENI.

1. Q: What is the main purpose of an Elastic IP address?

A: To provide a stable public IPv4 address that can be reassociated with another supported resource.

1. Q: Can an ENI be attached to an instance in another Availability Zone?

A: No. The ENI and instance must be in the same Availability Zone.

1. Q: Where are security groups associated?

A: With ENIs.

1. Q: When should an architecture move an ENI instead of only moving an Elastic IP?

A: When the private IP, security groups, and network-interface identity should move together.

1. Q: Does an Elastic IP automatically provide health checks and automated failover?

A: No. It only provides a persistent public address and reassociation capability.

1. Q: What does the EC2 operating system normally see for an instance with a public IPv4 address?

A: The private IPv4 address on the ENI; the public association is handled outside the guest OS.

1. Q: What is a common alternative to manually moving an Elastic IP for a public application?

A: A load balancer, Route 53-based design, or AWS Global Accelerator, depending on requirements.

1. Q: Why must unused Elastic IPs and public IPv4 allocations be released?

A: They can incur public IPv4 charges and create unnecessary resource-management and security concerns.

Practice Questions

Question 1

A company runs a licensing server on one EC2 instance. External customers allowlist the server’s public IPv4 address. The instance may be stopped and started during maintenance, but the allowlisted address must remain unchanged. Which solution meets the requirement with the least architectural change?

A. Use the instance’s automatically assigned public IPv4 address
B. Assign an Elastic IP to the instance
C. Assign a secondary private IPv4 address
D. Create a new ENI in another Availability Zone

Correct answer: B. Assign an Elastic IP to the instance.

An Elastic IP provides a stable public IPv4 address that remains available across stop/start operations and can be reassociated if the instance is replaced. A secondary private address is not publicly reachable by itself, and an automatically assigned public address can change.

Question 2

An operations team wants to fail over a service from an EC2 instance to a standby instance. The service must retain its private IPv4 address and the security groups associated with its application interface. Both instances are in the same Availability Zone. Which action is most appropriate?

A. Allocate a new public IPv4 address for the standby instance
B. Move only the primary private IP address through application configuration
C. Detach the application ENI from the active instance and attach it to the standby
D. Create an ENI in a different Availability Zone and attach it to the standby

Correct answer: C. Detach the application ENI from the active instance and attach it to the standby.

Moving the ENI preserves its private addressing and attached security groups. The interface must be in the same Availability Zone as the target instance, so option D is invalid.

Question 3

An EC2 instance is configured with a primary ENI in us-east-1a. An administrator creates a secondary ENI in us-east-1b and attempts to attach it to the instance. What should the architect explain?

A. The attachment succeeds only if both subnets have identical route tables
B. The attachment succeeds after enabling enhanced networking
C. The ENI cannot be attached because ENIs are Availability Zone-specific
D. The attachment succeeds, but the ENI will receive only a public IPv4 address

Correct answer: C. The ENI cannot be attached because ENIs are Availability Zone-specific.

An ENI belongs to the subnet and its Availability Zone. To support the instance in us-east-1a, create the secondary ENI in a subnet in us-east-1a.

Question 4

A developer stops and starts an EC2 instance and reports that the public DNS hostname changed, while the primary private IPv4 address stayed the same. Which explanation is correct?

A. The VPC route table automatically changed the private address
B. The automatically assigned public IPv4 address was released and replaced
C. The security group generated a new DNS hostname
D. The ENI was automatically recreated in another Availability Zone

Correct answer: B. The automatically assigned public IPv4 address was released and replaced.

The primary private address normally persists, but an automatically assigned public IPv4 address is not persistent across stop/start. EC2’s public DNS hostname can reflect that changed public address.

Question 5

A public application currently uses a manually reassociated Elastic IP for failover between EC2 instances. The business now requires multi-AZ deployment, health-based routing, and horizontal scaling. Which redesign is most appropriate?

A. Add more Elastic IPs to the same ENI
B. Use a single secondary ENI in the original Availability Zone
C. Deploy the instances across Availability Zones behind an appropriate Elastic Load Balancing service
D. Use automatically assigned public IPv4 addresses and update clients after every replacement

Correct answer: C. Deploy the instances across Availability Zones behind an appropriate Elastic Load Balancing service.

A load balancer provides a managed abstraction for multi-AZ distribution, health checks, and scaling. Elastic IP reassociation is useful for simpler address-persistence requirements but does not itself provide these capabilities.