An Elastic Network Interface (ENI) is a virtual network interface that can be attached to an ECS instance in a VPC. You can use an ENI to deploy a high-availability cluster, and perform low-cost failover and fine-grained network management in all Alibaba Cloud regions.


ENIs are suitable for:

  • Deploying a high-availability cluster

    An ENI is suitable for high-availability architecture for multiple network interfaces on a single instance.

  • Providing a low-cost failover solution

    You can detach an ENI from a failed ECS instance and then attach it to another ECS instance to quickly redirect traffic from the failed instance to a backup instance, thereby quickly restoring your services.

  • Managing the network with refined controls

    You can configure multiple ENIs for an instance in any Alibaba Cloud region. For example, you can use some ENIs for internal management and other ENIs for Internet business access, so as to isolate confidential data from business data. You can also configure specific security group rules for each ENI based on the source IP address, protocols, ports, and more to achieve secured traffic control.

ENI types

ENIs are classified into two types:

  • Primary ENI

    The ENI created by default upon the creation of an instance in a VPC. The life cycle of the primary ENI is the same as that of the instance, and you cannot remove the primary ENI from the instance.

  • Secondary ENI

    You can create a secondary ENI and attach it to an instance or detach it from the instance. The maximum number of ENIs that you can attach to one instance varies with the instance type. For more information, see Instance type families.

ENI attributes

The following table describes ENI attributes.

Attribute Quantity
Private IP address Varies with instance types
MAC address 1
Security group 1 to 5
ENI name 1


ENIs have the following limits:

  • There is an upper limit on the number of ENIs that can be created for one account in each region. For more information, see Limits on ENIs.
  • The ECS instance and its attached secondary ENI must be in the same zone and region, but can be in different VSwitches andsecurity groups.
  • The number of secondary ENIs that can be attached to an ECS instance depends on the instance type. For more information, see Instance type families.
  • Only I/O-optimized instance types support ENIs.
  • ECS instances in a classic network do not support ENIs.
  • The instance bandwidth varies with the instance type. You cannot increase the bandwidth of an ECS instance by attaching multiple ENIs to the instance.

Related operations

For images that cannot identify secondary ENIs, log on to the instance to configure the ENI.

Console operations

In the ECS console, you can view information of an attached ENI. You can also perform the following actions with a secondary ENI only (a primary ENI is not supported):

API operations

You can call DescribeNetworkInterfaces to query an ENI list, and call DescribeInstances to query the information of a specific ENI attached to an instance. Additionally, you can call the following API actions as needed for a secondary ENI only (a primary ENI is not supported):