How do I troubleshoot the "exceeded the maximum limit for Lambda Hyperplane elastic network interfaces for your VPC" error for a Lambda function?

Short description

When you configure a Lambda function to access resources in an Amazon VPC, Lambda creates a Hyperplane elastic network interface. Lambda creates the Hyperplane network interface the first time you define a unique subnet and security group combination.

The default quota limit for network interfaces for Amazon VPC is 500. If you exceed the network interface quota, then you get a limit exceeded error.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Identify the usage of network interfaces in your  VPC

To find the total number of Hyperplane network interfaces in use by Lambda for your Amazon VPC, run the describe-network-interfaces command:

aws ec2 describe-network-interfaces --region your-region \
  --filters 'Name=vpc-id,Values=your-VPC' 'Name=status,Values=in-use' \
  --query 'NetworkInterfaces[?InterfaceType==`lambda`].NetworkInterfaceId'

Note: Replace your-region with your AWS Region and your-VPC with your Amazon VPC ID.

To find the network interface that belongs to a Lambda function, run the Lambda ENI Finder bash script on the GitHub website.

Remove VPC configurations for functions that don't access private resources

It's a best practice to configure an Amazon VPC for your Lambda function to only access private resources. After you update a function to remove its Amazon VPC configuration, Lambda deletes the attached Hyperplane network interface.

Note: Lambda only deletes the Hyperplane network interface when no other functions or published versions use that Hyperplane network interface.

To identify a function that uses an network interface, see Why can't I detach or delete an elastic network interface that Lambda created?

Remove unused versions for active functions and reuse network interfaces

If your Lambda function configured with your Amazon VPC has multiple published versions, then it's a best practice to remove unused versions. Removal of unused Lambda function versions helps to release unused Hyperplane network interfaces.

If a Lambda function remains idle for consecutive weeks, then Lambda reclaims the unused Hyperplane network interfaces and sets the function state to idle. Lambda doesn't delete Hyperplane network interfaces that are in use by Lambda functions.

Lambda reuses the Hyperplane network interface for other Amazon VPC activated functions in your AWS account that use the same subnet and security group combination. To reuse the network interfaces across functions, configure the same security group subnet pairing.

For more information, see Understanding Hyperplane Elastic Network Interfaces (ENIs).

Note: It's a best practice to share network interfaces to reduce the number of interfaces needed when possible.

Open a quota increase case in the Service Quotas dashboard

If you determine that you require a higher service quota for Hyperplane network interfaces, then request a quota increase.

Related information

How do I request a concurrency limit increase for my Lambda function?