Orphaned network interfaces: How to Find Them and What They Cost

Orphaned network interfaces are ENIs left in the available state, holding IP addresses and blocking the deletion of the security groups and subnets they reference. They are one of the most reliable sources of pure waste in an AWS account, because nothing in the console flags them and nothing fails when they exist — the bill simply stays higher than it needs to be.

This page covers what they cost, the command that lists yours, and — importantly — what to check before deleting anything.

What they are and why they linger

An elastic network interface in the available state costs nothing directly, which is why it belongs in a cost review anyway: it holds a subnet address, keeps a security group undeletable, and blocks subnet and VPC deletion. That last one is the reason “I cannot delete this VPC” is one of the most common AWS support questions.

They are created on your behalf by many services — Lambda in a VPC, VPC endpoints, RDS, ECS tasks in awsvpc mode, EFS mount targets, Directory Service — and occasionally outlive their creator.

What they cost

Zero, directly. The costs are indirect and real: exhausted subnet addresses that block pod or task scheduling, an inability to tear down a decommissioned VPC (so everything else in it keeps billing), and security groups that cannot be cleaned up because something invisible still references them.

An orphaned ENI attached to an Elastic IP is a different matter — that combination bills the IPv4 charge indefinitely.

Finding yours

# Available ENIs, with what created them.
aws ec2 describe-network-interfaces --filters Name=status,Values=available \
  --query 'NetworkInterfaces[].{Id:NetworkInterfaceId,Subnet:SubnetId,Desc:Description,IP:PrivateIpAddress,Type:InterfaceType}' \
  --output table

The Description field is the key to attribution — it usually names the creator:

Description starts with	Created by
AWS Lambda VPC ENI	A VPC-attached Lambda function
VPC Endpoint Interface	An interface VPC endpoint
ELB app/ or ELB net/	A load balancer node
RDSNetworkInterface	An RDS instance
arn:aws:ecs:	An ECS task in awsvpc mode
EFS mount target	An EFS mount target
aws-K8S-i-	The EKS VPC CNI on a node

Read the description before deleting. It tells you whether the parent resource still exists.

Before you delete

Deleting an ENI that a service still owns can break that service. Lambda ENIs in particular can appear idle between invocations; AWS manages their lifecycle and will clean them up on its own schedule after the function’s VPC configuration is removed.

Only delete an ENI when the resource named in its description is definitively gone. If the description names a Lambda function that still exists, leave it alone.

To find what is blocking a security group deletion:

aws ec2 describe-network-interfaces \
  --filters Name=group-id,Values=sg-0123456789abcdef0 \
  --query 'NetworkInterfaces[].[NetworkInterfaceId,Status,Description]' --output text

Stopping them coming back

Delete resources in dependency order, and prefer infrastructure-as-code that understands the graph. Most orphaned ENIs come from deleting a parent resource in the console while something else still referenced it.

When decommissioning a VPC, remove Lambda VPC configurations and interface endpoints first — those two account for the majority of ENIs that block a teardown.

Related

• Unassociated Elastic IPs — public IPv4 addresses allocated to the account and attached to nothing — billed hourly and consuming a quota of five
• Idle load balancers — Application and Network Load Balancers with no healthy targets or no requests, billing hourly regardless
• The whole cost-waste checklist — every category in this series
• NAT gateway cost calculator — model the largest recurring VPC charge

---

Prices quoted are us-east-1 list rates, last checked on 2026-08-22, and are shown with the arithmetic so you can substitute the rates for your own region. Always confirm against the AWS pricing page before acting on a number.