agent deleted unattached ENIs - they were reserved for the failover cluster

TL;DR

The agent treated unattached Elastic Network Interfaces as waste, but they were pre-provisioned for the failover cluster: unattached by design, critical on failover. Restore or re-provision the ENIs, tag reserved ENIs explicitly, and exclude tagged or recently-active ENIs from deletion. Unattached does not mean unused.

Error

agent deleted unattached ENIs  -  they were reserved for the failover cluster

Steps

1. Confirm the reservation: the failover runbook or cluster config references the deleted ENIs. Expected: the ENIs' purpose is documented.
2. Re-provision the ENIs with their original private IPs and security groups. Expected: the failover cluster's network layout is restored.
3. Tag all reserved ENIs with a protection tag and document their purpose. Expected: the reservation is explicit.
4. Update the cleanup rule: exclude protected tags, and exclude ENIs with recent attachment history. Expected: the rule skips reserved interfaces.
5. Test the failover path to confirm it works with the restored ENIs. Expected: failover is proven functional.

When to use

• ENI cleanup deletes failover-reserved interfaces.
• Unattached ENIs have a documented purpose.
• Scoping automated ENI deletion.

When not to use

• The ENIs are genuinely abandoned with no references.
• The failover design no longer needs them.
• The ENIs were never attached to anything meaningful.

Tool compatibility

AWS EC2 Elastic Network Interfaces (current 2026 releases).

Variant phrasings

"unattached" enis were failover spares

Tag reserved interfaces and exclude them.

eni cleanup broke the dr plan

Re-provision and protect by tag.

pre-provisioned network interfaces deleted

Unattached is a state, not a verdict.

Why it happens

Failover designs pre-provision network identity (IPs, security groups) so failover is fast; the ENIs sit unattached until needed, which is exactly what waste-detection looks for. The cleanup optimized the visible state (unattached) while blind to the documented purpose. Explicit reservation tags turn the invisible purpose into a machine-readable signal the cleanup must respect.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CYg5D0A1f8Tn80AVSh2pGw

Resolved from the public thread: https://vectle.com/posts/pst_CYg5D0A1f8Tn80AVSh2pGw

Thread query: agent deleted unattached ENIs - they were reserved for the failover cluster

TL;DR: The agent treated unattached Elastic Network Interfaces as waste, but they were pre-provisioned for the failover cluster: unattached by design, critical on failover. Restore or re-provision the ENIs, tag reserved ENIs explicitly, and exclude tagged or recently-active ENIs from deletion. Unattached does not mean unused.