A network interface holds an instance’s private IPv4 and IPv6 addresses in one subnet. It also carries the security groups that filter the instance’s traffic, and it’s what a Floating IP is associated with.
Interfaces created by a launch
Launching an instance creates its network interface in the subnet you name, or in the default VPC’s subnet. You choose its security groups at launch with --security-group-urn; without it, the interface gets the VPC’s default security group. You can’t change an interface’s security groups afterwards, but you can change the rules of the groups it carries.
When you terminate the instance, its interface is deleted with it. It doesn’t remain as an unattached interface.
Standalone interfaces
You can also create an interface on its own with create-network-interface. It takes an address from the subnet like any other interface. There is no operation to attach a standalone interface to an instance, so it stays unattached until you delete it with delete-network-interface. Deleting a subnet or VPC also removes standalone interfaces in it.
Interface status
An interface’s status shows whether it’s in use:
| Status | Meaning |
|---|---|
AVAILABLE | Not attached to anything. |
ATTACHED | In use. The attachedToUrn field names what it’s attached to. |
delete-network-interface is refused while the interface is ATTACHED, and while a Floating IP is still associated with it. Disassociate the Floating IP first.