ENILimitReachedException: The elastic network interface limit was reached for the function's VPC

What it means

When a Lambda is attached to a VPC, every execution environment it creates needs a path into your network. Lambda provides that with a shared elastic network interface — one per unique combination of subnets and security groups, not one per concurrent execution, which is what makes VPC-attached functions scale at all. But interfaces still consume addresses from your subnets, and both the addresses and the interfaces are finite.

The result is a failure that is invisible until the day it is not. At low concurrency the function needs very little, everything works, and no test reproduces anything. Then a queue backs up or a scheduled job fans out, Lambda tries to scale, and there is nowhere to put the new environments. The invocations that cannot get an interface fail before your code runs.

Two different ceilings produce this, and the exception name is what tells them apart. SubnetIPAddressLimitReachedException means your subnet ran out of IP addresses — and subnets are sized once, early, usually by someone who was not thinking about Lambda concurrency. A /28 has sixteen addresses, five of which AWS reserves, leaving eleven for everything in that subnet including whatever else already lives there. ENILimitReachedException means the account's interface quota for the region is the binding constraint, which is a support request rather than a CIDR change.

ENINotReadyException is a third thing again and worth not confusing with the other two. It is a race, not a ceiling: an interface was being provisioned and was not usable at the moment an invocation arrived. It clears on its own, and the correct response is a retry rather than a capacity change — which is exactly the wrong response to the other two.

What it looks like in CloudWatch

This is the shape the failure arrives in: the lines of one invocation scattered among everything else the log group received at the same moment.

The panel on the right is generated by running the excerpt on the left through the same parser that powers the free web stitcher — it is what the tool actually produces for this input, not an illustration of it.

How to confirm it from the logs

Correlate the failures with concurrency rather than with input. This never fires on a quiet function and never reproduces in testing; it fires when a spike asks Lambda to create more execution environments than the VPC can supply interfaces or addresses for.

The exception name narrows it. SubnetIPAddressLimitReached means the subnet's CIDR has no free addresses left — the fix is a bigger or additional subnet. ENILimitReached means the account's interface quota in the region is the constraint, which is a quota increase. ENINotReady is timing rather than capacity: an interface was being created and was not usable yet.

Causes, most likely first

Fixes

yaml# A /28 gives 11 usable addresses. A /24 gives 251.
LambdaSubnetA:
  Type: AWS::EC2::Subnet
  Properties:
    VpcId: !Ref Vpc
    CidrBlock: 10.0.16.0/24
    AvailabilityZone: !Select [0, !GetAZs '']

bashaws ec2 describe-subnets --subnet-ids subnet-0abc subnet-0def \
  --query 'Subnets[].{Id:SubnetId,Cidr:CidrBlock,Free:AvailableIpAddressCount}'

yamlResources:
  VpcFunction:
    Type: AWS::Serverless::Function
    Properties:
      ReservedConcurrentExecutions: 50

Also seen as

The same underlying failure, worded differently by a different runtime, SDK version, or logging layer. All of these land here — there is no separate page for each phrasing.

Related errors

Errors that show up alongside this one, or that people mistake for it.

References

• AWS Lambda Developer Guide — Connecting outbound networking to resources in a VPC
• AWS Lambda Developer Guide — Lambda quotas