Why can't I detach or delete an elastic network interface that Lambda created?

4 minute read
0

When I try to detach or delete an elastic network interface that AWS Lambda created, I get the following error message: "You are not allowed to manage 'ela-attach' attachments."

Short description

When you configure a Lambda function to access resources in an Amazon Virtual Private Cloud (Amazon VPC), Lambda assigns the function to a network interface. You can delete this network interface only through the Lambda service. If you delete the resources that the network interface represents, then Lambda detaches and deletes the network interface for you. To delete unused network interfaces, the Lambda service uses the execution role of the functions that created the network interfaces.

A network interface might be used by functions or function versions with the same Amazon VPC configurations as the functions that created them. In this case, you can't delete the network interface.

To identify which functions or function versions currently use a network interface, use the Lambda ENI Finder bash script on the GitHub website. For more information, see Requester-managed network interfaces.

Note: Lambda shares network interfaces across multiple functions that have the same Amazon VPC configuration. To reduce the number of network interfaces that are used in your AWS account, you can share network interfaces.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Run the Lambda ENI Finder to identify functions and function versions that use the network interface

Note: The following commands are valid only for Linux, Unix, and macOS operating systems.

To identify functions and function versions that use the network interface, complete the following steps:

  1. Configure the AWS CLI with an AWS Identity and Access Management (IAM) role that has permissions to query Lambda and network interfaces. For more information, see Execution role and user permissions.
    Note: Lambda uses the permissions in a function's execution role to delete the Hyperplane elastic network interface. Don't delete the execution role before Lambda deletes the Hyperplane elastic network interface.

  2. Install the command-line JSON processor jq from the jq website:

    $ sudo yum install jq -y
  3. Verify that Git is installed:

    $ sudo yum install git -y

    To install Git, see Getting started - Installing Git on the Git website.

  4. Clone the aws-support-tools GitHub repository from the GitHub website:

    $ git clone https://github.com/awslabs/aws-support-tools.git
  5. Change the directory to the location of Lambda ENI Finder:

    $ cd aws-support-tools
    $ cd Lambda
    $ cd FindEniMappings
  6. Run the Lambda ENI Finder for the network interface that you want to delete:

    ./findEniAssociations --eni eni-0123456789abcef01 --region us-east-1

    Note: Replace eni-0123456789abcef01 with the network interface's ID. You can find the ID on the Network Interfaces page of the Amazon Elastic Compute Cloud (Amazon EC2) console. Replace us-east-1 with the AWS Region that the network interface is in.

The output returns a list of the Lambda functions and function versions in your AWS account and specified Region that use the network interface. If you need any of these functions or function versions, then don't delete the network interface.

Delete a network interface that Lambda created

To delete a network interface that Lambda created, complete the following steps:

  1. For each unpublished Lambda function version ($LATEST) that the Lambda ENI Finder lists, take one of the following actions:
    Change the Amazon VPC configuration to use a different subnet and security group.
    -or-
    Disconnect the function from the Amazon VPC.
  2. For each published Lambda function version that's listed, delete the function version.
    Note: You can't edit published function versions, so you can't change the VPC configuration.
  3. Verify that the network interface is no longer in use. To do this, run the Lambda ENI Finder again.

If the output lists no other functions or function versions, then Lambda automatically deletes the network interface within 20 minutes.

Related information

How do I get more elastic network interfaces if I've reached the limit in an AWS Region?

AWS OFFICIAL
AWS OFFICIALUpdated 22 days ago
3 Comments

Thanks, this post finally resolved my issue by finding the lambda linked with the dangling ENI

Tom
replied 3 months ago

If the output lists no other functions or function versions, then Lambda automatically deletes the network interface within 24 hours.

this is out-of-date information; the docs state that automatic deletion now happens within 20 minutes.

Deleting ENIs When you update a function to remove its VPC configuration, Lambda requires up to 20 minutes to delete the attached Hyperplane ENI. Lambda only deletes the ENI if no other function (or published function version) is using that Hyperplane ENI.

https://docs.aws.amazon.com/lambda/latest/dg/foundation-networking.html#foundation-nw-eni-delete

replied a month ago

Thank you for your comment. We'll review and update the Knowledge Center article as needed.

profile pictureAWS
MODERATOR
replied a month ago