An engineer wants to quickly fail over a network-intensive appliance from one EC2 instance to a standby instance by detaching the appliance's elastic network interface (ENI) from the failed instance and attaching it to the standby instance, preserving the same private IP address. Under what condition does this work?
- It works regardless of Availability Zone, as long as both instances are in the same VPC
- It works regardless of VPC, as long as both instances are in the same Availability Zone and AWS account
- It works only if the network interface is the primary network interface of the failed instance, since secondary network interfaces cannot be detached and reattached
- It works only if both instances are in the same Availability Zone as the network interface itself, since a network interface can only be attached to instances located in the Availability Zone in which it was created
Why D? And why not the others?
Correct answer: D. It works only if both instances are in the same Availability Zone as the network interface itself, since a network interface can only be attached to instances located in the Availability Zone in which it was created
An elastic network interface belongs to the Availability Zone it was created in and can only be attached to EC2 instances that also live in that same Availability Zone; its attributes, including its private IP address, follow it as it is detached and reattached, which is exactly what lets this failover pattern preserve the appliance's address on the standby instance. The 'same VPC, any AZ' option is wrong because AZ-scoping, not VPC-scoping, is the binding constraint — a network interface cannot be attached to an instance in a different AZ even within the same VPC. The 'same AZ and account, any VPC' option is wrong because a network interface is also tied to the subnet and VPC it was created in, not just an Availability Zone. The 'primary interface only' option is wrong because it inverts the real restriction: a primary network interface can never be detached from its instance at all, so this kind of detach-and-reattach failover is only possible with a secondary network interface, not the primary one.
Source: AWS EC2 User Guide: Elastic network interfaces — 'You can create and configure network interfaces and attach them to instances that you launch in the same Availability Zone' and 'You can't detach a primary network interface from an instance.'