OpenParable
Skip to content
← Back to skills

Cis AWS Compute 2.10

DevOps & Security
cis-aws-compute-2.10

Cis AWS Compute 2.10 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure unused ENIs are removed

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_Compute_Services_Benchmark_v1.1.0/cis-aws-compute-2.10/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-compute-2-10, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Ensure unused ENIs are removed

Description

Identify and delete any unused Amazon AWS Elastic Network Interfaces in order to adhere to best practices and to avoid reaching the service limit. An AWS Elastic Network Interface (ENI) is pronounced unused when is not attached anymore to an EC2 instance.

Rationale

Removing unused ENIs helps maintain a clean environment, reduces potential attack surface, and avoids reaching service limits.

Impact

Deleting an ENI is permanent. Ensure the ENI is truly unused before removal.

Audit Procedure

Using AWS CLI

  1. Run describe-network-interfaces command:
aws ec2 describe-network-interfaces --region us-east-1 --output json --filters Name=status,Values=available --query "NetworkInterfaces[*].{ENI:NetworkInterfaceId}"
  1. The command output should return an empty list if no unused ENIs exist.
  2. If there is a list of ENI IDs then refer to the remediation below.
  3. Repeat steps 1 - 3 to determine the current status for any other ENIs within the current region.

NOTE Repeat the audit process for all other regions used.

Using AWS Console

  1. Login to EC2 using https://console.aws.amazon.com/ec2/
  2. On the left Click NETWORK & SECURITY, click Network Interfaces.
  3. Select the ENI that you want to review.
  4. Go to the Details tab.
  5. Check the value set for the Status attribute.
  6. If it says available, refer to the remediation below.
  7. Repeat steps 3 - 6 to determine the current status for any other ENIs within the current region.

NOTE Repeat the audit process for all other regions used.

Expected Result

The CLI command should return an empty list, indicating no ENIs are in the available (unattached) state.

Remediation

Using AWS CLI

  1. Run the delete-network-interface command with the ENI names collected above in the audit:
aws ec2 delete-network-interface --region us-east-1 --network-interface-id eni-1234abcd
  1. This will remove the ENI that is not being used.
  2. Repeat steps 1 - 2 for any ENIs within the current region.

NOTE Repeat the audit process for all other regions used.

Using AWS Console

  1. Login to EC2 using https://console.aws.amazon.com/ec2/
  2. On the left Click NETWORK & SECURITY, click Network Interfaces.
  3. Select the ENI that you want to remove.
  4. Click 'Actions', then 'delete'.
  5. Click Delete.
  6. Repeat steps 3 - 5 any other ENIs listed in the audit within the current region.

NOTE Repeat the audit process for all other regions used.

Default Value

ENIs are not automatically cleaned up when detached from instances.

References

No specific references provided in the benchmark for this control.

CIS Controls

Controls VersionControlIG 1IG 2IG 3
v812.2 Establish and Maintain a Secure Network Architecturexx
v711.1 Maintain Standard Security Configurations for Network Devicesxx

Profile

Level 1 | Manual