In AWS, when you're trying to **delete or detach a network interface (ENI)** and encounter the error:


> **"You do not have permission to access the specified resource."**


this usually means **one of two main things**:


---


### ✅ 1. **Permission Denied by IAM Policy**


You are likely **not authorized via IAM policy** to perform `ec2:DetachNetworkInterface` or `ec2:DeleteNetworkInterface`.


#### 🔍 Root Cause:


Check whether your IAM role/user has the following permissions:


```json
{
  "Effect": "Allow",
  "Action": [
    "ec2:DescribeNetworkInterfaces",
    "ec2:DetachNetworkInterface",
    "ec2:DeleteNetworkInterface"
  ],
  "Resource": "*"
}
```


If your IAM policy does **not include these**, or there's a **Deny** statement in an SCP (Service Control Policy) or permissions boundary, you'll see that error.


---


### ✅ 2. **ENI is Attached to a System-Owned Resource**


Even with full permissions, AWS will **block you from detaching/deleting an ENI** if it’s **attached to a managed or system-owned resource**, such as:


* The **primary ENI** of an EC2 instance.
* A **Lambda** function (if it's a VPC-attached Lambda).
* An **ECS task**.
* An **AWS Load Balancer**.
* An **Elastic File System (EFS)** mount target.


#### 🔍 Root Cause:


Each ENI has a **`Attachment` block** in the metadata. If it's `Attachment.Status = "attached"` and the `InstanceOwnerId != aws_account_id`, then the resource is **owned by AWS**, and cannot be detached manually.


You can inspect it with:


```bash
aws ec2 describe-network-interfaces --network-interface-ids eni-xxxxxxxx
```


And look for:


```json
"Attachment": {
    "InstanceOwnerId": "amazon-elb",  <-- or another system
    "Status": "attached",
    ...
}
```


---


### 🛠️ How to Fix


#### 🔸 Case A: **IAM Permission Issue**


* Ask your admin to attach a policy with the `ec2:DetachNetworkInterface` and `ec2:DeleteNetworkInterface` actions.
* Check for **SCPs** or **Permissions Boundaries** that might override your IAM permissions.


#### 🔸 Case B: **System-Owned ENI**


* You **must delete the parent resource** (e.g., Lambda function, ECS task, EC2 instance) that owns the ENI.
* Once deleted, the ENI will be **automatically detached and removed** (in most cases).
* You **cannot detach primary ENIs** of running EC2 instances.


---


Would you like help interpreting the output of `describe-network-interfaces` for your specific ENI?