Merge lp:~dimitern/goamz/nic-api-calls into lp:goamz

[Dimiter Naydenov]

ec2: Add VPC NetworkInterface-related APIs

Added the following new API calls:
- CreateNetworkInterface
- DeleteNetworkInterface
- NetworkInterfaces
- AttachNetworkInterface
- DetachNetworkInterface
(and related types/responses)

Modified existing calls/types:
- SecurityGroupInfo now includes VPCId field
- Add CreateSecurityGroupVPC call that does
the same as CreateSecurityGroup, but sets
the VPCId, to create a VPC group

This enables us to handle VPC NICs with
goamz and partially handle private IP
addresses for them. Next, we'll add more
VPC-related stuff to Instances.

Tested live on EC2, extended ec2test package
as needed.

Added a couple of test helpers: createSubnet,
and deleteSubnets, used to make sure we wait
for the events to happen when running against
live EC2 servers, and we don't leave stuff
around after the tests. With these the live
tests pass and clean up properly.

https://codereview.appspot.com/54570048/

[Dimiter Naydenov (dimitern)]

Reviewers: mp+204912_code.launchpad.net,

Message:
Please take a look.

Description:
ec2: Add VPC NetworkInterface-related APIs

Added the following new API calls:
- CreateNetworkInterface
- DeleteNetworkInterface
- NetworkInterfaces
- AttachNetworkInterface
- DetachNetworkInterface
(and related types/responses)

Modified existing calls/types:
- SecurityGroupInfo now includes VPCId field
- Add CreateSecurityGroupVPC call that does
the same as CreateSecurityGroup, but sets
the VPCId, to create a VPC group

This enables us to handle VPC NICs with
goamz and partially handle private IP
addresses for them. Next, we'll add more
calls for private IP addresses management.

Tested live on EC2, extended ec2test package
as needed.

https://code.launchpad.net/~dimitern/goamz/nic-api-calls/+merge/204912

Requires:
https://code.launchpad.net/~dimitern/goamz/subnets-api-calls/+merge/204640

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/54570048/

Affected files (+1004, -15 lines):
   A [revision details]
   M ec2/ec2.go
   M ec2/ec2_test.go
   M ec2/ec2t_test.go
   M ec2/ec2test/server.go
   A ec2/networkinterfaces.go
   A ec2/networkinterfaces_test.go
   M ec2/responses_test.go

[lp:~dimitern/goamz/nic-api-calls]

54. By Dimiter Naydenov on 2014-02-05

Fixed a test slightly

[Dimiter Naydenov (dimitern)]

Please take a look.

https://codereview.appspot.com/54570048/

[Roger Peppe (rogpeppe)]

LGTM with some minor suggestions below.

Thanks!

https://codereview.appspot.com/54570048/diff/20001/ec2/ec2.go
File ec2/ec2.go (right):

https://codereview.appspot.com/54570048/diff/20001/ec2/ec2.go#newcode635
ec2/ec2.go:635: // CreateSecurityGroup run a CreateSecurityGroup request
in EC2, with
s/run/runs/

https://codereview.appspot.com/54570048/diff/20001/ec2/ec2.go#newcode643
ec2/ec2.go:643: // CreateSecurityGroupVPC creates a security group in
EC2, associated
s/,//

// If vpcId is empty, this call is equivalent to CreateSecurityGroup.

?

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go
File ec2/networkinterfaces.go (right):

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go#newcode80
ec2/networkinterfaces.go:80: // You can specify a primary private IP
address by setting
Why have we got both PrivateIPs and PrivateIPAddress?

Couldn't we have PrivateIPs only and avoid the question
of what happens when they're both set?

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go#newcode84
ec2/networkinterfaces.go:84: // If you don't specify a private IP
address, EC2 selects one for you
// If a private IP address is not specified, EC2 selects
// one from the subnet range.

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go#newcode87
ec2/networkinterfaces.go:87: // SecondaryPrivateIPsCount is the number
of secondary private IP
// When SecondaryPrivateIPsCount is non-zero,
// EC2 allocates that number of
// IP addresses from within the subnet range.
// The number of IP addresses you
// can assign to a network interface varies by instance type.

?

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go#newcode149
ec2/networkinterfaces.go:149: // You must detach the network interface
before you can delete it.
// DeleteNetworkInterface deletes the specified network interface,
// which must have been previously detached.

?

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go#newcode192
ec2/networkinterfaces.go:192: // AttachNetworkInterfaceResp is the
response to a
s/ a/ an/

https://codereview.appspot.com/54570048/

[lp:~dimitern/goamz/nic-api-calls]

55. By Dimiter Naydenov on 2014-02-06

Merged parent

56. By Dimiter Naydenov on 2014-02-06

Merged subnets-api-calls into nic-api-calls.

57. By Dimiter Naydenov on 2014-02-06

Changes after review; tests improvements

[Dimiter Naydenov (dimitern)]

Please take a look.

https://codereview.appspot.com/54570048/diff/20001/ec2/ec2.go
File ec2/ec2.go (right):

https://codereview.appspot.com/54570048/diff/20001/ec2/ec2.go#newcode635
ec2/ec2.go:635: // CreateSecurityGroup run a CreateSecurityGroup request
in EC2, with
On 2014/02/05 15:17:35, rog wrote:
> s/run/runs/

Done.

https://codereview.appspot.com/54570048/diff/20001/ec2/ec2.go#newcode643
ec2/ec2.go:643: // CreateSecurityGroupVPC creates a security group in
EC2, associated
On 2014/02/05 15:17:35, rog wrote:
> s/,//

> // If vpcId is empty, this call is equivalent to CreateSecurityGroup.

> ?

Done.

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go
File ec2/networkinterfaces.go (right):

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go#newcode80
ec2/networkinterfaces.go:80: // You can specify a primary private IP
address by setting
On 2014/02/05 15:17:35, rog wrote:
> Why have we got both PrivateIPs and PrivateIPAddress?

> Couldn't we have PrivateIPs only and avoid the question
> of what happens when they're both set?

I tried to stay close to the AWS API, which allows both but with some
conditions. Having PrivateIPAddress and setting just that is a shortcut
to setting PrivateIPs: []ec2.PrivateIP{{Address: "..", IsPrimary:
true}}. But perhaps the slightly more verbose syntax will work well to
hide the API complexity.

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go#newcode84
ec2/networkinterfaces.go:84: // If you don't specify a private IP
address, EC2 selects one for you
On 2014/02/05 15:17:35, rog wrote:
> // If a private IP address is not specified, EC2 selects
> // one from the subnet range.

Done slightly differently.

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go#newcode87
ec2/networkinterfaces.go:87: // SecondaryPrivateIPsCount is the number
of secondary private IP
On 2014/02/05 15:17:35, rog wrote:
> // When SecondaryPrivateIPsCount is non-zero,
> // EC2 allocates that number of
> // IP addresses from within the subnet range.
> // The number of IP addresses you
> // can assign to a network interface varies by instance type.

> ?

Done.

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go#newcode149
ec2/networkinterfaces.go:149: // You must detach the network interface
before you can delete it.
On 2014/02/05 15:17:35, rog wrote:
> // DeleteNetworkInterface deletes the specified network interface,
> // which must have been previously detached.

> ?

Done.

https://codereview.appspot.com/54570048/diff/20001/ec2/networkinterfaces.go#newcode192
ec2/networkinterfaces.go:192: // AttachNetworkInterfaceResp is the
response to a
On 2014/02/05 15:17:35, rog wrote:
> s/ a/ an/

Done.

https://codereview.appspot.com/54570048/

[lp:~dimitern/goamz/nic-api-calls]

58. By Dimiter Naydenov on 2014-02-07

Merged subnets-api-calls into nic-api-calls.

59. By Dimiter Naydenov on 2014-02-07

Changes after reivew

60. By Dimiter Naydenov on 2014-02-07

Merge fixes

[Dimiter Naydenov (dimitern)]

Please take a look.

https://codereview.appspot.com/54570048/

[Gustavo Niemeyer (niemeyer)]

LGTM

https://codereview.appspot.com/54570048/diff/60001/ec2/ec2.go
File ec2/ec2.go (right):

https://codereview.appspot.com/54570048/diff/60001/ec2/ec2.go#newcode637
ec2/ec2.go:637: // the provided name and description.
Would you mind to update this to be slightly more sane:

// CreateSecurityGroup creates a security group with the provided name
// and description.

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go
File ec2/networkinterfaces.go (right):

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode8
ec2/networkinterfaces.go:8: // Written by Gustavo Niemeyer
<email address hidden>
Please drop this line.

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode52
ec2/networkinterfaces.go:52: // NetworkInterface describes a network
interface for AWS VPC.
s/ AWS//

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode78
ec2/networkinterfaces.go:78: // Only the SubnetId is required, the rest
are optional.
// SubnetId is the only required field.

This already implies that the rest is optional.

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode81
ec2/networkinterfaces.go:81: // PrivateIPs slice. Only one of them can
be set as primary.
// Only one provided PrivateIP may be set as primary.

It's implicit that one or more may be provided.

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode93
ec2/networkinterfaces.go:93: SecondaryPrivateIPsCount int
s/IPsCount/IPCount/? That seems to read better, and also matches the
plural form used by the underlying EC2 parameter.

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode163
ec2/networkinterfaces.go:163: // interfaces to the matching ids or
filtering rules.
// NetworkInterfaces returns a list of network interfaces.
//
// If the ids or filter parameters are provided, only matching
interfaces
// are returned.

https://codereview.appspot.com/54570048/diff/60001/ec2/subnets_test.go
File ec2/subnets_test.go (right):

https://codereview.appspot.com/54570048/diff/60001/ec2/subnets_test.go#newcode94
ec2/subnets_test.go:94: // Subnet tests to run against either a local
test server or live on EC2.
s/ to// -- the original sentence was correct ("These tests run
against...")

https://codereview.appspot.com/54570048/

[Dimiter Naydenov (dimitern)]

*** Submitted:

ec2: Add VPC NetworkInterface-related APIs

Added the following new API calls:
- CreateNetworkInterface
- DeleteNetworkInterface
- NetworkInterfaces
- AttachNetworkInterface
- DetachNetworkInterface
(and related types/responses)

Modified existing calls/types:
- SecurityGroupInfo now includes VPCId field
- Add CreateSecurityGroupVPC call that does
the same as CreateSecurityGroup, but sets
the VPCId, to create a VPC group

This enables us to handle VPC NICs with
goamz and partially handle private IP
addresses for them. Next, we'll add more
VPC-related stuff to Instances.

Tested live on EC2, extended ec2test package
as needed.

Added a couple of test helpers: createSubnet,
and deleteSubnets, used to make sure we wait
for the events to happen when running against
live EC2 servers, and we don't leave stuff
around after the tests. With these the live
tests pass and clean up properly.

R=rog, niemeyer
CC=
https://codereview.appspot.com/54570048

https://codereview.appspot.com/54570048/diff/60001/ec2/ec2.go
File ec2/ec2.go (right):

https://codereview.appspot.com/54570048/diff/60001/ec2/ec2.go#newcode637
ec2/ec2.go:637: // the provided name and description.
On 2014/02/12 14:22:38, niemeyer wrote:
> Would you mind to update this to be slightly more sane:

> // CreateSecurityGroup creates a security group with the provided name
> // and description.

Done.

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go
File ec2/networkinterfaces.go (right):

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode8
ec2/networkinterfaces.go:8: // Written by Gustavo Niemeyer
<email address hidden>
On 2014/02/12 14:22:38, niemeyer wrote:
> Please drop this line.

Done.

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode52
ec2/networkinterfaces.go:52: // NetworkInterface describes a network
interface for AWS VPC.
On 2014/02/12 14:22:38, niemeyer wrote:
> s/ AWS//

Done.

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode78
ec2/networkinterfaces.go:78: // Only the SubnetId is required, the rest
are optional.
On 2014/02/12 14:22:38, niemeyer wrote:
> // SubnetId is the only required field.

> This already implies that the rest is optional.

Done.

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode81
ec2/networkinterfaces.go:81: // PrivateIPs slice. Only one of them can
be set as primary.
On 2014/02/12 14:22:38, niemeyer wrote:
> // Only one provided PrivateIP may be set as primary.

> It's implicit that one or more may be provided.

Done.

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode93
ec2/networkinterfaces.go:93: SecondaryPrivateIPsCount int
On 2014/02/12 14:22:38, niemeyer wrote:
> s/IPsCount/IPCount/? That seems to read better, and also matches the
plural
> form used by the underlying EC2 parameter.

Done. Also, as agreed on IRC, I'll rename NetworkInterfaceOptions to
CreateNetworkInterface.

https://codereview.appspot.com/54570048/diff/60001/ec2/networkinterfaces.go#newcode163
ec2/networkinterfaces.go:163: // interfaces to the matching ids or
filter...

[Dimiter Naydenov (dimitern)]

Post-submit approval.

review: Approve

=== modified file 'ec2/ec2.go'
--- ec2/ec2.go	2014-02-07 12:56:14 +0000
+++ ec2/ec2.go	2014-02-07 12:56:14 +0000
@@ -633,14 +633,26 @@
 	RequestId string `xml:"requestId"`
 }
 
-// CreateSecurityGroup run a CreateSecurityGroup request in EC2, with the provided
-// name and description.
+// CreateSecurityGroup runs a CreateSecurityGroup request in EC2, with
+// the provided name and description.
 //
 // See http://goo.gl/Eo7Yl for more details.
 func (ec2 *EC2) CreateSecurityGroup(name, description string) (resp *CreateSecurityGroupResp, err error) {
-	params := makeParams("CreateSecurityGroup")
+	return ec2.CreateSecurityGroupVPC("", name, description)
+}
+
+// CreateSecurityGroupVPC creates a security group in EC2, associated
+// with the given VPC ID. If vpcId is empty, this call is equivalent
+// to CreateSecurityGroup.
+//
+// See http://goo.gl/Eo7Yl for more details.
+func (ec2 *EC2) CreateSecurityGroupVPC(vpcId, name, description string) (resp *CreateSecurityGroupResp, err error) {
+	params := makeParamsVPC("CreateSecurityGroup")
 	params["GroupName"] = name
 	params["GroupDescription"] = description
+	if vpcId != "" {
+		params["VpcId"] = vpcId
+	}
 
 	resp = &CreateSecurityGroupResp{}
 	err = ec2.query(params, resp)
@@ -665,6 +677,7 @@
 // See http://goo.gl/CIdyP for more details.
 type SecurityGroupInfo struct {
 	SecurityGroup
+	VPCId       string   `xml:"vpcId"`
 	OwnerId     string   `xml:"ownerId"`
 	Description string   `xml:"groupDescription"`
 	IPPerms     []IPPerm `xml:"ipPermissions>item"`

=== modified file 'ec2/ec2_test.go'
--- ec2/ec2_test.go	2014-02-07 12:56:14 +0000
+++ ec2/ec2_test.go	2014-02-07 12:56:14 +0000
@@ -400,20 +400,30 @@
 	c.Assert(s0.Tags[0].Value, Equals, "demo_db_14_backup")
 }
 
+func (s *S) checkCreateSGResponse(c *C, resp *ec2.CreateSecurityGroupResp, id, name, description, vpcId string) {
+	req := testServer.WaitRequest()
+	c.Assert(req.Form["Action"], DeepEquals, []string{"CreateSecurityGroup"})
+	c.Assert(req.Form["GroupName"], DeepEquals, []string{name})
+	c.Assert(req.Form["GroupDescription"], DeepEquals, []string{description})
+	if vpcId != "" {
+		c.Assert(req.Form["VpcId"], DeepEquals, []string{vpcId})
+	}
+
+	c.Assert(resp.RequestId, Equals, "59dbff89-35bd-4eac-99ed-be587EXAMPLE")
+	c.Assert(resp.Name, Equals, name)
+	c.Assert(resp.Id, Equals, id)
+}
+
 func (s *S) TestCreateSecurityGroupExample(c *C) {
 	testServer.Response(200, nil, CreateSecurityGroupExample)
-
 	resp, err := s.ec2.CreateSecurityGroup("websrv", "Web Servers")
-
-	req := testServer.WaitRequest()
-	c.Assert(req.Form["Action"], DeepEquals, []string{"CreateSecurityGroup"})
-	c.Assert(req.Form["GroupName"], DeepEquals, []string{"websrv"})
-	c.Assert(req.Form["GroupDescription"], DeepEquals, []string{"Web Servers"})
-
-	c.Assert(err, IsNil)
-	c.Assert(resp.RequestId, Equals, "59dbff89-35bd-4eac-99ed-be587EXAMPLE")
-	c.Assert(resp.Name, Equals, "websrv")
-	c.Assert(resp.Id, Equals, "sg-67ad940e")
+	c.Assert(err, IsNil)
+	s.checkCreateSGResponse(c, resp, "sg-67ad940e", "websrv", "Web Servers", "")
+
+	testServer.Response(200, nil, CreateSecurityGroupExample)
+	resp, err = s.ec2.CreateSecurityGroupVPC("vpc-id", "websrv", "Web Servers")
+	c.Assert(err, IsNil)
+	s.checkCreateSGResponse(c, resp, "sg-67ad940e", "websrv", "Web Servers", "vpc-id")
 }
 
 func (s *S) TestDescribeSecurityGroupsExample(c *C) {

=== modified file 'ec2/ec2t_test.go'
--- ec2/ec2t_test.go	2014-02-07 12:56:14 +0000
+++ ec2/ec2t_test.go	2014-02-07 12:56:14 +0000
@@ -148,13 +148,17 @@
 }
 
 func (s *ServerTests) makeTestGroup(c *C, name, descr string) ec2.SecurityGroup {
+	return s.makeTestGroupVPC(c, "", name, descr)
+}
+
+func (s *ServerTests) makeTestGroupVPC(c *C, vpcId, name, descr string) ec2.SecurityGroup {
 	// Clean it up if a previous test left it around.
 	_, err := s.ec2.DeleteSecurityGroup(ec2.SecurityGroup{Name: name})
 	if err != nil && s.errorCode(err) != "InvalidGroup.NotFound" {
 		c.Fatalf("delete security group: %v", err)
 	}
 
-	resp, err := s.ec2.CreateSecurityGroup(name, descr)
+	resp, err := s.ec2.CreateSecurityGroupVPC(vpcId, name, descr)
 	c.Assert(err, IsNil)
 	c.Assert(resp.Name, Equals, name)
 	return resp.SecurityGroup

=== modified file 'ec2/ec2test/server.go'
--- ec2/ec2test/server.go	2014-02-07 12:56:14 +0000
+++ ec2/ec2test/server.go	2014-02-07 12:56:14 +0000
@@ -17,6 +17,7 @@
 	"strconv"
 	"strings"
 	"sync"
+	"time"
 )
 
 var b64 = base64.StdEncoding
@@ -52,6 +53,8 @@
 	groups               map[string]*securityGroup // id -> group
 	vpcs                 map[string]*vpc           // id -> vpc
 	subnets              map[string]*subnet        // id -> subnet
+	ifaces               map[string]*iface         // id -> iface
+	attachments          map[string]*attachment    // id -> attachment
 	maxId                counter
 	reqId                counter
 	reservationId        counter
@@ -59,6 +62,8 @@
 	vpcId                counter
 	dhcpOptsId           counter
 	subnetId             counter
+	ifaceId              counter
+	attachId             counter
 	initialInstanceState ec2.InstanceState
 }
 
@@ -103,6 +108,7 @@
 	id          string
 	name        string
 	description string
+	vpcId       string
 
 	perms map[permKey]bool
 }
@@ -236,6 +242,41 @@
 	return false, fmt.Errorf("unknown attribute %q", attr)
 }
 
+type iface struct {
+	ec2.NetworkInterface
+}
+
+func (i *iface) matchAttr(attr, value string) (ok bool, err error) {
+	notImplemented := []string{
+		"addresses.", "association.", "tag", "requester-",
+		"attachment.", "source-dest-check", "mac-address",
+		"group-", "description", "private-", "owner-id",
+	}
+	switch attr {
+	case "availability-zone":
+		return i.AvailZone == value, nil
+	case "network-interface-id":
+		return i.Id == value, nil
+	case "status":
+		return i.Status == value, nil
+	case "subnet-id":
+		return i.SubnetId == value, nil
+	case "vpc-id":
+		return i.VPCId == value, nil
+	default:
+		for _, item := range notImplemented {
+			if strings.HasPrefix(attr, item) {
+				return false, fmt.Errorf("%q filter not implemented", attr)
+			}
+		}
+	}
+	return false, fmt.Errorf("unknown attribute %q", attr)
+}
+
+type attachment struct {
+	ec2.NetworkInterfaceAttachment
+}
+
 var actions = map[string]func(*Server, http.ResponseWriter, *http.Request, string) interface{}{
 	"RunInstances":                  (*Server).runInstances,
 	"TerminateInstances":            (*Server).terminateInstances,
@@ -251,6 +292,11 @@
 	"CreateSubnet":                  (*Server).createSubnet,
 	"DeleteSubnet":                  (*Server).deleteSubnet,
 	"DescribeSubnets":               (*Server).describeSubnets,
+	"CreateNetworkInterface":        (*Server).createIFace,
+	"DeleteNetworkInterface":        (*Server).deleteIFace,
+	"DescribeNetworkInterfaces":     (*Server).describeIFaces,
+	"AttachNetworkInterface":        (*Server).attachIFace,
+	"DetachNetworkInterface":        (*Server).detachIFace,
 }
 
 const ownerId = "9876"
@@ -273,6 +319,8 @@
 		groups:               make(map[string]*securityGroup),
 		vpcs:                 make(map[string]*vpc),
 		subnets:              make(map[string]*subnet),
+		ifaces:               make(map[string]*iface),
+		attachments:          make(map[string]*attachment),
 		reservations:         make(map[string]*reservation),
 		initialInstanceState: Pending,
 	}
@@ -1152,6 +1200,158 @@
 	return &resp
 }
 
+func (srv *Server) createIFace(w http.ResponseWriter, req *http.Request, reqId string) interface{} {
+	s := srv.subnet(req.Form.Get("SubnetId"))
+	ipMap := make(map[int]ec2.PrivateIP)
+	primaryIP := req.Form.Get("PrivateIpAddress")
+	if primaryIP != "" {
+		ipMap[0] = ec2.PrivateIP{Address: primaryIP, IsPrimary: true}
+	}
+	desc := req.Form.Get("Description")
+
+	var groups []ec2.SecurityGroup
+	for name, vals := range req.Form {
+		if strings.HasPrefix(name, "SecurityGroupId.") {
+			g := ec2.SecurityGroup{Id: vals[0]}
+			sg := srv.group(g)
+			if sg == nil {
+				fatalf(400, "InvalidGroup.NotFound", "no such group %v", g)
+			}
+			groups = append(groups, sg.ec2SecurityGroup())
+		}
+		if strings.HasPrefix(name, "PrivateIpAddresses.") {
+			var ip ec2.PrivateIP
+			parts := strings.Split(name, ".")
+			index := atoi(parts[1]) - 1
+			if index < 0 {
+				fatalf(400, "InvalidParameterValue", "invalid index %s", name)
+			}
+			if _, ok := ipMap[index]; ok {
+				ip = ipMap[index]
+			}
+			switch parts[2] {
+			case "PrivateIpAddress":
+				ip.Address = vals[0]
+			case "Primary":
+				val, err := strconv.ParseBool(vals[0])
+				if err != nil {
+					fatalf(400, "InvalidParameterValue", "bad flag %s: %s", name, vals[0])
+				}
+				ip.IsPrimary = val
+			}
+			ipMap[index] = ip
+		}
+	}
+	privateIPs := make([]ec2.PrivateIP, len(ipMap))
+	for index, ip := range ipMap {
+		if ip.IsPrimary {
+			primaryIP = ip.Address
+		}
+		privateIPs[index] = ip
+	}
+
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+	i := &iface{ec2.NetworkInterface{
+		Id:               fmt.Sprintf("eni-%d", srv.ifaceId.next()),
+		SubnetId:         s.Id,
+		VPCId:            s.VPCId,
+		AvailZone:        s.AvailZone,
+		Description:      desc,
+		OwnerId:          ownerId,
+		Status:           ec2.AvailableStatus,
+		MACAddress:       fmt.Sprintf("%02d:81:60:cb:27:37", srv.ifaceId),
+		PrivateIPAddress: primaryIP,
+		SourceDestCheck:  true,
+		Groups:           groups,
+		PrivateIPs:       privateIPs,
+	}}
+	srv.ifaces[i.Id] = i
+	r := &ec2.CreateNetworkInterfaceResp{
+		RequestId:        reqId,
+		NetworkInterface: i.NetworkInterface,
+	}
+	return r
+}
+
+func (srv *Server) deleteIFace(w http.ResponseWriter, req *http.Request, reqId string) interface{} {
+	i := srv.iface(req.Form.Get("NetworkInterfaceId"))
+
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+
+	delete(srv.ifaces, i.Id)
+	return &ec2.SimpleResp{
+		XMLName:   xml.Name{"", "DeleteNetworkInterface"},
+		RequestId: reqId,
+	}
+}
+
+func (srv *Server) describeIFaces(w http.ResponseWriter, req *http.Request, reqId string) interface{} {
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+
+	idMap := collectIds(req.Form, "NetworkInterfaceId.")
+	f := newFilter(req.Form)
+	var resp ec2.NetworkInterfacesResp
+	resp.RequestId = reqId
+	for _, i := range srv.ifaces {
+		ok, err := f.ok(i)
+		if ok && (len(idMap) == 0 || idMap[i.Id]) {
+			resp.Interfaces = append(resp.Interfaces, i.NetworkInterface)
+		} else if err != nil {
+			fatalf(400, "InvalidParameterValue", "describe ifaces: %v", err)
+		}
+	}
+	return &resp
+}
+
+func (srv *Server) attachIFace(w http.ResponseWriter, req *http.Request, reqId string) interface{} {
+	i := srv.iface(req.Form.Get("NetworkInterfaceId"))
+	inst := srv.instance(req.Form.Get("InstanceId"))
+	devIndex := atoi(req.Form.Get("DeviceIndex"))
+
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+	a := &attachment{ec2.NetworkInterfaceAttachment{
+		Id:                  fmt.Sprintf("eni-attach-%d", srv.attachId.next()),
+		InstanceId:          inst.id(),
+		InstanceOwnerId:     ownerId,
+		DeviceIndex:         devIndex,
+		Status:              ec2.InUseStatus,
+		AttachTime:          time.Now().Format(time.RFC3339),
+		DeleteOnTermination: true,
+	}}
+	srv.attachments[a.Id] = a
+	i.Attachment = a.NetworkInterfaceAttachment
+	srv.ifaces[i.Id] = i
+	r := &ec2.AttachNetworkInterfaceResp{
+		RequestId:    reqId,
+		AttachmentId: a.Id,
+	}
+	return r
+}
+
+func (srv *Server) detachIFace(w http.ResponseWriter, req *http.Request, reqId string) interface{} {
+	att := srv.attachment(req.Form.Get("AttachmentId"))
+
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+
+	for _, i := range srv.ifaces {
+		if i.Attachment.Id == att.Id {
+			i.Attachment = ec2.NetworkInterfaceAttachment{}
+			srv.ifaces[i.Id] = i
+			break
+		}
+	}
+	delete(srv.attachments, att.Id)
+	return &ec2.SimpleResp{
+		XMLName:   xml.Name{"", "DetachNetworkInterface"},
+		RequestId: reqId,
+	}
+}
+
 func (r *reservation) hasRunningMachine() bool {
 	for _, inst := range r.instances {
 		if inst.state.Code != ShuttingDown.Code && inst.state.Code != Terminated.Code {
@@ -1197,6 +1397,49 @@
 	return s
 }
 
+func (srv *Server) iface(id string) *iface {
+	if id == "" {
+		fatalf(400, "MissingParameter", "missing networkInterfaceId")
+	}
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+	i, found := srv.ifaces[id]
+	if !found {
+		fatalf(400, "InvalidNetworkInterfaceID.NotFound", "interface %s not found", id)
+	}
+	return i
+}
+
+func (srv *Server) instance(id string) *Instance {
+	if id == "" {
+		fatalf(400, "MissingParameter", "missing instanceId")
+	}
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+	inst, found := srv.instances[id]
+	if !found {
+		fatalf(400, "InvalidInstanceID.NotFound", "instance %s not found", id)
+	}
+	return inst
+}
+
+func (srv *Server) attachment(id string) *attachment {
+	if id == "" {
+		fatalf(400, "MissingParameter", "missing attachmentId")
+	}
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+	att, found := srv.attachments[id]
+	if !found {
+		fatalf(
+			400,
+			"InvalidNetworkInterfaceAttachmentId.NotFound",
+			"attachment %s not found", id,
+		)
+	}
+	return att
+}
+
 // collectIds takes all values with the given prefix from form and
 // returns a map with the ids as keys.
 func collectIds(form url.Values, prefix string) map[string]bool {

=== added file 'ec2/networkinterfaces.go'
--- ec2/networkinterfaces.go	1970-01-01 00:00:00 +0000
+++ ec2/networkinterfaces.go	2014-02-07 12:56:14 +0000
@@ -0,0 +1,223 @@
+//
+// goamz - Go packages to interact with the Amazon Web Services.
+//
+//   https://wiki.ubuntu.com/goamz
+//
+// Copyright (c) 2014 Canonical Ltd.
+//
+// Written by Gustavo Niemeyer <[e-mail]>
+//
+
+package ec2
+
+import (
+	"fmt"
+	"strconv"
+)
+
+// NetworkInterfaceAttachment describes a network interface
+// attachment.
+//
+// See http://goo.gl/KtiKuV for more details.
+type NetworkInterfaceAttachment struct {
+	Id                  string `xml:"attachmentId"`
+	InstanceId          string `xml:"instanceId"`
+	InstanceOwnerId     string `xml:"instanceOwnerId"`
+	DeviceIndex         int    `xml:"deviceIndex"`
+	Status              string `xml:"status"`
+	AttachTime          string `xml:"attachTime"`
+	DeleteOnTermination bool   `xml:"deleteOnTermination"`
+}
+
+const (
+	// Common status values for network interfaces / attachments.
+	AvailableStatus = "available"
+	AttachingStatus = "attaching"
+	AttachedStatus  = "attached"
+	PendingStatus   = "pending"
+	InUseStatus     = "in-use"
+	DetachingStatus = "detaching"
+	DetachedStatus  = "detached"
+)
+
+// PrivateIP describes a private IP address of a network interface.
+//
+// See http://goo.gl/jtuQEJ for more details.
+type PrivateIP struct {
+	Address   string `xml:"privateIpAddress"`
+	DNSName   string `xml:"privateDnsName"`
+	IsPrimary bool   `xml:"primary"`
+}
+
+// NetworkInterface describes a network interface for AWS VPC.
+//
+// See http://goo.gl/G63OQL for more details.
+type NetworkInterface struct {
+	Id               string                     `xml:"networkInterfaceId"`
+	SubnetId         string                     `xml:"subnetId"`
+	VPCId            string                     `xml:"vpcId"`
+	AvailZone        string                     `xml:"availabilityZone"`
+	Description      string                     `xml:"description"`
+	OwnerId          string                     `xml:"ownerId"`
+	RequesterId      string                     `xml:"requesterId"`
+	RequesterManaged bool                       `xml:"requesterManaged"`
+	Status           string                     `xml:"status"`
+	MACAddress       string                     `xml:"macAddress"`
+	PrivateIPAddress string                     `xml:"privateIpAddress"`
+	PrivateDNSName   string                     `xml:"privateDnsName"`
+	SourceDestCheck  bool                       `xml:"sourceDestCheck"`
+	Groups           []SecurityGroup            `xml:"groupSet>item"`
+	Attachment       NetworkInterfaceAttachment `xml:"attachment"`
+	Tags             []Tag                      `xml:"tagSet>item"`
+	PrivateIPs       []PrivateIP                `xml:"privateIpAddressesSet>item"`
+}
+
+// NetworkInterfaceOptions encapsulates options for the
+// CreateNetworkInterface call.
+//
+// Only the SubnetId is required, the rest are optional.
+//
+// One or more private IP addresses can be specified by using the
+// PrivateIPs slice. Only one of them can be set as primary.
+//
+// If PrivateIPs is empty, EC2 selects a primary private IP from the
+// subnet range.
+//
+// When SecondaryPrivateIPsCount is non-zero, EC2 allocates that
+// number of IP addresses from within the subnet range.  The number of
+// IP addresses you can assign to a network interface varies by
+// instance type.
+type NetworkInterfaceOptions struct {
+	SubnetId                 string
+	PrivateIPs               []PrivateIP
+	SecondaryPrivateIPsCount int
+	Description              string
+	SecurityGroupIds         []string
+}
+
+// CreateNetworkInterfaceResp is the response to a
+// CreateNetworkInterface request.
+//
+// See http://goo.gl/ze3VhA for more details.
+type CreateNetworkInterfaceResp struct {
+	RequestId        string           `xml:"requestId"`
+	NetworkInterface NetworkInterface `xml:"networkInterface"`
+}
+
+// CreateNetworkInterface creates a network interface in the specified
+// subnet.
+//
+// See http://goo.gl/ze3VhA for more details.
+func (ec2 *EC2) CreateNetworkInterface(opts NetworkInterfaceOptions) (resp *CreateNetworkInterfaceResp, err error) {
+	params := makeParamsVPC("CreateNetworkInterface")
+	params["SubnetId"] = opts.SubnetId
+	for i, ip := range opts.PrivateIPs {
+		prefix := fmt.Sprintf("PrivateIpAddresses.%d.", i+1)
+		params[prefix+"PrivateIpAddress"] = ip.Address
+		params[prefix+"Primary"] = strconv.FormatBool(ip.IsPrimary)
+	}
+	if opts.Description != "" {
+		params["Description"] = opts.Description
+	}
+	if opts.SecondaryPrivateIPsCount > 0 {
+		count := strconv.Itoa(opts.SecondaryPrivateIPsCount)
+		params["SecondaryPrivateIpAddressCount"] = count
+	}
+	for i, groupId := range opts.SecurityGroupIds {
+		params["SecurityGroupId."+strconv.Itoa(i+1)] = groupId
+	}
+	resp = &CreateNetworkInterfaceResp{}
+	err = ec2.query(params, resp)
+	if err != nil {
+		return nil, err
+	}
+	return resp, nil
+}
+
+// DeleteNetworkInterface deletes the specified network interface,
+// which must have been previously detached.
+//
+// See http://goo.gl/MC1yOj for more details.
+func (ec2 *EC2) DeleteNetworkInterface(id string) (resp *SimpleResp, err error) {
+	params := makeParamsVPC("DeleteNetworkInterface")
+	params["NetworkInterfaceId"] = id
+	resp = &SimpleResp{}
+	err = ec2.query(params, resp)
+	if err != nil {
+		return nil, err
+	}
+	return resp, nil
+}
+
+// NetworkInterfacesResp is the response to a NetworkInterfaces
+// request.
+//
+// See http://goo.gl/2LcXtM for more details.
+type NetworkInterfacesResp struct {
+	RequestId  string             `xml:"requestId"`
+	Interfaces []NetworkInterface `xml:"networkInterfaceSet>item"`
+}
+
+// NetworkInterfaces describes one or more network interfaces. Both
+// parameters are optional, and if specified will limit the returned
+// interfaces to the matching ids or filtering rules.
+//
+// See http://goo.gl/2LcXtM for more details.
+func (ec2 *EC2) NetworkInterfaces(ids []string, filter *Filter) (resp *NetworkInterfacesResp, err error) {
+	params := makeParamsVPC("DescribeNetworkInterfaces")
+	for i, id := range ids {
+		params["NetworkInterfaceId."+strconv.Itoa(i+1)] = id
+	}
+	filter.addParams(params)
+
+	resp = &NetworkInterfacesResp{}
+	err = ec2.query(params, resp)
+	if err != nil {
+		return nil, err
+	}
+	return resp, nil
+}
+
+// AttachNetworkInterfaceResp is the response to an
+// AttachNetworkInterface request.
+//
+// See http://goo.gl/rEbSii for more details.
+type AttachNetworkInterfaceResp struct {
+	RequestId    string `xml:"requestId"`
+	AttachmentId string `xml:"attachmentId"`
+}
+
+// AttachNetworkInterface attaches a network interface to an instance.
+//
+// See http://goo.gl/rEbSii for more details.
+func (ec2 *EC2) AttachNetworkInterface(interfaceId, instanceId string, deviceIndex int) (resp *AttachNetworkInterfaceResp, err error) {
+	params := makeParamsVPC("AttachNetworkInterface")
+	params["NetworkInterfaceId"] = interfaceId
+	params["InstanceId"] = instanceId
+	params["DeviceIndex"] = strconv.Itoa(deviceIndex)
+	resp = &AttachNetworkInterfaceResp{}
+	err = ec2.query(params, resp)
+	if err != nil {
+		return nil, err
+	}
+	return resp, nil
+}
+
+// DetachNetworkInterface detaches a network interface from an
+// instance.
+//
+// See http://goo.gl/0Xc1px for more details.
+func (ec2 *EC2) DetachNetworkInterface(attachmentId string, force bool) (resp *SimpleResp, err error) {
+	params := makeParamsVPC("DetachNetworkInterface")
+	params["AttachmentId"] = attachmentId
+	if force {
+		// Force is optional.
+		params["Force"] = "true"
+	}
+	resp = &SimpleResp{}
+	err = ec2.query(params, resp)
+	if err != nil {
+		return nil, err
+	}
+	return resp, nil
+}

=== added file 'ec2/networkinterfaces_test.go'
--- ec2/networkinterfaces_test.go	1970-01-01 00:00:00 +0000
+++ ec2/networkinterfaces_test.go	2014-02-07 12:56:14 +0000
@@ -0,0 +1,367 @@
+//
+// goamz - Go packages to interact with the Amazon Web Services.
+//
+//   https://wiki.ubuntu.com/goamz
+//
+// Copyright (c) 2014 Canonical Ltd.
+//
+// Written by Gustavo Niemeyer <[e-mail]>
+//
+
+package ec2_test
+
+import (
+	"launchpad.net/goamz/aws"
+	"launchpad.net/goamz/ec2"
+	. "launchpad.net/gocheck"
+	"time"
+)
+
+// Network interface tests with example responses
+
+func (s *S) TestCreateNetworkInterfaceExample(c *C) {
+	testServer.Response(200, nil, CreateNetworkInterfaceExample)
+
+	resp, err := s.ec2.CreateNetworkInterface(ec2.NetworkInterfaceOptions{
+		SubnetId: "subnet-b2a249da",
+		PrivateIPs: []ec2.PrivateIP{
+			{Address: "10.0.2.157", IsPrimary: true},
+		},
+		SecurityGroupIds: []string{"sg-1a2b3c4d"},
+	})
+	req := testServer.WaitRequest()
+
+	c.Assert(req.Form["Action"], DeepEquals, []string{"CreateNetworkInterface"})
+	c.Assert(req.Form["SubnetId"], DeepEquals, []string{"subnet-b2a249da"})
+	c.Assert(req.Form["PrivateIpAddress"], HasLen, 0)
+	c.Assert(
+		req.Form["PrivateIpAddresses.1.PrivateIpAddress"],
+		DeepEquals,
+		[]string{"10.0.2.157"},
+	)
+	c.Assert(
+		req.Form["PrivateIpAddresses.1.Primary"],
+		DeepEquals,
+		[]string{"true"},
+	)
+	c.Assert(req.Form["Description"], HasLen, 0)
+	c.Assert(req.Form["SecurityGroupId.1"], DeepEquals, []string{"sg-1a2b3c4d"})
+
+	c.Assert(err, IsNil)
+	c.Assert(resp.RequestId, Equals, "8dbe591e-5a22-48cb-b948-dd0aadd55adf")
+	iface := resp.NetworkInterface
+	c.Check(iface.Id, Equals, "eni-cfca76a6")
+	c.Check(iface.SubnetId, Equals, "subnet-b2a249da")
+	c.Check(iface.VPCId, Equals, "vpc-c31dafaa")
+	c.Check(iface.AvailZone, Equals, "ap-southeast-1b")
+	c.Check(iface.Description, Equals, "")
+	c.Check(iface.OwnerId, Equals, "251839141158")
+	c.Check(iface.RequesterManaged, Equals, false)
+	c.Check(iface.Status, Equals, ec2.AvailableStatus)
+	c.Check(iface.MACAddress, Equals, "02:74:b0:72:79:61")
+	c.Check(iface.PrivateIPAddress, Equals, "10.0.2.157")
+	c.Check(iface.SourceDestCheck, Equals, true)
+	c.Check(iface.Groups, DeepEquals, []ec2.SecurityGroup{
+		{Id: "sg-1a2b3c4d", Name: "default"},
+	})
+	c.Check(iface.Tags, HasLen, 0)
+	c.Check(iface.PrivateIPs, DeepEquals, []ec2.PrivateIP{
+		{Address: "10.0.2.157", IsPrimary: true},
+	})
+}
+
+func (s *S) TestDeleteNetworkInterfaceExample(c *C) {
+	testServer.Response(200, nil, DeleteNetworkInterfaceExample)
+
+	resp, err := s.ec2.DeleteNetworkInterface("eni-id")
+	req := testServer.WaitRequest()
+
+	c.Assert(req.Form["Action"], DeepEquals, []string{"DeleteNetworkInterface"})
+	c.Assert(req.Form["NetworkInterfaceId"], DeepEquals, []string{"eni-id"})
+
+	c.Assert(err, IsNil)
+	c.Assert(resp.RequestId, Equals, "e1c6d73b-edaa-4e62-9909-6611404e1739")
+}
+
+func (s *S) TestNetworkInterfacesExample(c *C) {
+	testServer.Response(200, nil, DescribeNetworkInterfacesExample)
+
+	ids := []string{"eni-0f62d866", "eni-a66ed5cf"}
+	resp, err := s.ec2.NetworkInterfaces(ids, nil)
+	req := testServer.WaitRequest()
+
+	c.Assert(req.Form["Action"], DeepEquals, []string{"DescribeNetworkInterfaces"})
+	c.Assert(req.Form["NetworkInterfaceId.1"], DeepEquals, []string{ids[0]})
+	c.Assert(req.Form["NetworkInterfaceId.2"], DeepEquals, []string{ids[1]})
+
+	c.Assert(err, IsNil)
+	c.Assert(resp.RequestId, Equals, "fc45294c-006b-457b-bab9-012f5b3b0e40")
+	c.Check(resp.Interfaces, HasLen, 2)
+	iface := resp.Interfaces[0]
+	c.Check(iface.Id, Equals, ids[0])
+	c.Check(iface.SubnetId, Equals, "subnet-c53c87ac")
+	c.Check(iface.VPCId, Equals, "vpc-cc3c87a5")
+	c.Check(iface.AvailZone, Equals, "ap-southeast-1b")
+	c.Check(iface.Description, Equals, "")
+	c.Check(iface.OwnerId, Equals, "053230519467")
+	c.Check(iface.RequesterManaged, Equals, false)
+	c.Check(iface.Status, Equals, ec2.InUseStatus)
+	c.Check(iface.MACAddress, Equals, "02:81:60:cb:27:37")
+	c.Check(iface.PrivateIPAddress, Equals, "10.0.0.146")
+	c.Check(iface.SourceDestCheck, Equals, true)
+	c.Check(iface.Groups, DeepEquals, []ec2.SecurityGroup{
+		{Id: "sg-3f4b5653", Name: "default"},
+	})
+	c.Check(iface.Attachment, DeepEquals, ec2.NetworkInterfaceAttachment{
+		Id:                  "eni-attach-6537fc0c",
+		InstanceId:          "i-22197876",
+		InstanceOwnerId:     "053230519467",
+		DeviceIndex:         0,
+		Status:              ec2.AttachedStatus,
+		AttachTime:          "2012-07-01T21:45:27.000Z",
+		DeleteOnTermination: true,
+	})
+	c.Check(iface.PrivateIPs, DeepEquals, []ec2.PrivateIP{
+		{Address: "10.0.0.146", IsPrimary: true},
+		{Address: "10.0.0.148", IsPrimary: false},
+		{Address: "10.0.0.150", IsPrimary: false},
+	})
+	c.Check(iface.Tags, HasLen, 0)
+
+	iface = resp.Interfaces[1]
+	c.Check(iface.Id, Equals, ids[1])
+	c.Check(iface.SubnetId, Equals, "subnet-cd8a35a4")
+	c.Check(iface.VPCId, Equals, "vpc-f28a359b")
+	c.Check(iface.AvailZone, Equals, "ap-southeast-1b")
+	c.Check(iface.Description, Equals, "Primary network interface")
+	c.Check(iface.OwnerId, Equals, "053230519467")
+	c.Check(iface.RequesterManaged, Equals, false)
+	c.Check(iface.Status, Equals, "in-use")
+	c.Check(iface.MACAddress, Equals, "02:78:d7:00:8a:1e")
+	c.Check(iface.PrivateIPAddress, Equals, "10.0.1.233")
+	c.Check(iface.SourceDestCheck, Equals, true)
+	c.Check(iface.Groups, DeepEquals, []ec2.SecurityGroup{
+		{Id: "sg-a2a0b2ce", Name: "quick-start-1"},
+	})
+	c.Check(iface.Attachment, DeepEquals, ec2.NetworkInterfaceAttachment{
+		Id:                  "eni-attach-a99c57c0",
+		InstanceId:          "i-886401dc",
+		InstanceOwnerId:     "053230519467",
+		DeviceIndex:         0,
+		Status:              ec2.AttachedStatus,
+		AttachTime:          "2012-06-27T20:08:44.000Z",
+		DeleteOnTermination: true,
+	})
+	c.Check(iface.PrivateIPs, DeepEquals, []ec2.PrivateIP{
+		{Address: "10.0.1.233", IsPrimary: true},
+		{Address: "10.0.1.20", IsPrimary: false},
+	})
+	c.Check(iface.Tags, HasLen, 0)
+}
+
+func (s *S) TestAttachNetworkInterfaceExample(c *C) {
+	testServer.Response(200, nil, AttachNetworkInterfaceExample)
+
+	resp, err := s.ec2.AttachNetworkInterface("eni-id", "i-id", 0)
+	req := testServer.WaitRequest()
+
+	c.Assert(req.Form["Action"], DeepEquals, []string{"AttachNetworkInterface"})
+	c.Assert(req.Form["NetworkInterfaceId"], DeepEquals, []string{"eni-id"})
+	c.Assert(req.Form["InstanceId"], DeepEquals, []string{"i-id"})
+	c.Assert(req.Form["DeviceIndex"], DeepEquals, []string{"0"})
+
+	c.Assert(err, IsNil)
+	c.Assert(resp.RequestId, Equals, "ace8cd1e-e685-4e44-90fb-92014d907212")
+	c.Assert(resp.AttachmentId, Equals, "eni-attach-d94b09b0")
+}
+
+func (s *S) TestDetachNetworkInterfaceExample(c *C) {
+	testServer.Response(200, nil, DetachNetworkInterfaceExample)
+
+	resp, err := s.ec2.DetachNetworkInterface("eni-attach-id", true)
+	req := testServer.WaitRequest()
+
+	c.Assert(req.Form["Action"], DeepEquals, []string{"DetachNetworkInterface"})
+	c.Assert(req.Form["AttachmentId"], DeepEquals, []string{"eni-attach-id"})
+	c.Assert(req.Form["Force"], DeepEquals, []string{"true"})
+
+	c.Assert(err, IsNil)
+	c.Assert(resp.RequestId, Equals, "ce540707-0635-46bc-97da-33a8a362a0e8")
+}
+
+// Network interface tests run against either a local test server or
+// live on EC2.
+
+func (s *ServerTests) TestNetworkInterfaces(c *C) {
+	vpcResp, err := s.ec2.CreateVPC("10.3.0.0/16", "")
+	c.Assert(err, IsNil)
+	vpcId := vpcResp.VPC.Id
+	defer s.deleteVPCs(c, []string{vpcId})
+
+	subResp := s.createSubnet(c, vpcId, "10.3.1.0/24", "")
+	subId := subResp.Subnet.Id
+	defer s.deleteSubnets(c, []string{subId})
+
+	sg := s.makeTestGroupVPC(c, vpcId, "vpc-sg-1", "vpc test group1")
+	defer s.deleteGroups(c, []ec2.SecurityGroup{sg})
+
+	instList, err := s.ec2.RunInstances(&ec2.RunInstances{
+		ImageId:      imageId,
+		InstanceType: "t1.micro",
+		SubnetId:     subId,
+	})
+	c.Assert(err, IsNil)
+	inst := instList.Instances[0]
+	c.Assert(inst, NotNil)
+	instId := inst.InstanceId
+	defer s.ec2.TerminateInstances([]string{instId})
+
+	ips1 := []ec2.PrivateIP{{Address: "10.3.1.10", IsPrimary: true}}
+	resp1, err := s.ec2.CreateNetworkInterface(ec2.NetworkInterfaceOptions{
+		SubnetId:    subId,
+		PrivateIPs:  ips1,
+		Description: "My first iface",
+	})
+	c.Assert(err, IsNil)
+	assertNetworkInterface(c, resp1.NetworkInterface, "", subId, ips1)
+	c.Check(resp1.NetworkInterface.Description, Equals, "My first iface")
+	id1 := resp1.NetworkInterface.Id
+
+	ips2 := []ec2.PrivateIP{
+		{Address: "10.3.1.20", IsPrimary: true},
+		{Address: "10.3.1.22", IsPrimary: false},
+	}
+	resp2, err := s.ec2.CreateNetworkInterface(ec2.NetworkInterfaceOptions{
+		SubnetId:         subId,
+		PrivateIPs:       ips2,
+		SecurityGroupIds: []string{sg.Id},
+	})
+	c.Assert(err, IsNil)
+	assertNetworkInterface(c, resp2.NetworkInterface, "", subId, ips2)
+	c.Assert(resp2.NetworkInterface.Groups, DeepEquals, []ec2.SecurityGroup{sg})
+	id2 := resp2.NetworkInterface.Id
+
+	// We only check for the network interfaces we just created,
+	// because the user might have others in his account (when testing
+	// against the EC2 servers). In some cases it takes a short while
+	// until both interfaces are created, so we need to retry a few
+	// times to make sure.
+	testAttempt := aws.AttemptStrategy{
+		Total: 5 * time.Minute,
+		Delay: 5 * time.Second,
+	}
+	var list *ec2.NetworkInterfacesResp
+	done := false
+	for a := testAttempt.Start(); a.Next(); {
+		c.Logf("waiting for %v to be created", []string{id1, id2})
+		list, err = s.ec2.NetworkInterfaces(nil, nil)
+		if err != nil {
+			c.Logf("retrying; NetworkInterfaces returned: %v", err)
+			continue
+		}
+		found := 0
+		for _, iface := range list.Interfaces {
+			c.Logf("found NIC %v", iface)
+			switch iface.Id {
+			case id1:
+				assertNetworkInterface(c, iface, id1, subId, ips1)
+				found++
+			case id2:
+				assertNetworkInterface(c, iface, id2, subId, ips2)
+				found++
+			}
+			if found == 2 {
+				done = true
+				break
+			}
+		}
+		if done {
+			c.Logf("all NICs were created")
+			break
+		}
+	}
+	if !done {
+		c.Fatalf("timeout while waiting for NICs %v", []string{id1, id2})
+	}
+
+	list, err = s.ec2.NetworkInterfaces([]string{id1}, nil)
+	c.Assert(err, IsNil)
+	c.Assert(list.Interfaces, HasLen, 1)
+	assertNetworkInterface(c, list.Interfaces[0], id1, subId, ips1)
+
+	f := ec2.NewFilter()
+	f.Add("network-interface-id", id2)
+	list, err = s.ec2.NetworkInterfaces(nil, f)
+	c.Assert(err, IsNil)
+	c.Assert(list.Interfaces, HasLen, 1)
+	assertNetworkInterface(c, list.Interfaces[0], id2, subId, ips2)
+
+	// Attachment might fail if the instance is not running yet,
+	// so we retry for a while until it succeeds.
+	var attResp *ec2.AttachNetworkInterfaceResp
+	for a := testAttempt.Start(); a.Next(); {
+		attResp, err = s.ec2.AttachNetworkInterface(id2, instId, 1)
+		if err != nil {
+			c.Logf("AttachNetworkInterface returned: %v; retrying...", err)
+			attResp = nil
+			continue
+		}
+		c.Logf("AttachNetworkInterface succeeded")
+		c.Check(attResp.AttachmentId, Not(Equals), "")
+		break
+	}
+	if attResp == nil {
+		c.Fatalf("timeout while waiting for AttachNetworkInterface to succeed")
+	}
+
+	list, err = s.ec2.NetworkInterfaces([]string{id2}, nil)
+	c.Assert(err, IsNil)
+	att := list.Interfaces[0].Attachment
+	c.Check(att.Id, Equals, attResp.AttachmentId)
+	c.Check(att.InstanceId, Equals, instId)
+	c.Check(att.DeviceIndex, Equals, 1)
+	c.Check(att.Status, Matches, "("+ec2.AttachingStatus+"|"+ec2.InUseStatus+")")
+
+	_, err = s.ec2.DetachNetworkInterface(att.Id, true)
+	c.Check(err, IsNil)
+
+	_, err = s.ec2.DeleteNetworkInterface(id1)
+	c.Assert(err, IsNil)
+
+	// We might not be able to delete the interface until the
+	// detachment is completed, so we need to retry here as well.
+	for a := testAttempt.Start(); a.Next(); {
+		_, err = s.ec2.DeleteNetworkInterface(id2)
+		if err != nil {
+			c.Logf("DeleteNetworkInterface returned: %v; retrying...", err)
+			continue
+		}
+		c.Logf("DeleteNetworkInterface succeeded")
+		return
+	}
+	c.Fatalf("timeout while waiting for DeleteNetworkInterface to succeed")
+}
+
+func assertNetworkInterface(c *C, obtained ec2.NetworkInterface, expectId, expectSubId string, expectIPs []ec2.PrivateIP) {
+	if expectId != "" {
+		c.Check(obtained.Id, Equals, expectId)
+	} else {
+		c.Check(obtained.Id, Matches, `^eni-[0-9a-f]+$`)
+	}
+	statusRegExp := "(" +
+		ec2.AvailableStatus + "|" +
+		ec2.PendingStatus + "|" +
+		ec2.InUseStatus +
+		")"
+	c.Check(obtained.Status, Matches, statusRegExp)
+	if expectSubId != "" {
+		c.Check(obtained.SubnetId, Equals, expectSubId)
+	} else {
+		c.Check(obtained.SubnetId, Matches, `^subnet-[0-9a-f]+$`)
+	}
+	c.Check(obtained.Attachment, DeepEquals, ec2.NetworkInterfaceAttachment{})
+	if len(expectIPs) > 0 {
+		c.Check(obtained.PrivateIPs, DeepEquals, expectIPs)
+		c.Check(obtained.PrivateIPAddress, DeepEquals, expectIPs[0].Address)
+	}
+}

=== modified file 'ec2/responses_test.go'
--- ec2/responses_test.go	2014-02-07 12:56:14 +0000
+++ ec2/responses_test.go	2014-02-07 12:56:14 +0000
@@ -684,3 +684,151 @@
   </subnetSet>
 </DescribeSubnetsResponse>
 `
+
+// http://goo.gl/ze3VhA
+var CreateNetworkInterfaceExample = `
+<CreateNetworkInterfaceResponse xmlns="http://ec2.amazonaws.com/doc/2013-10-15/">
+ <requestId>8dbe591e-5a22-48cb-b948-dd0aadd55adf</requestId>
+    <networkInterface>
+        <networkInterfaceId>eni-cfca76a6</networkInterfaceId>
+        <subnetId>subnet-b2a249da</subnetId>
+        <vpcId>vpc-c31dafaa</vpcId>
+        <availabilityZone>ap-southeast-1b</availabilityZone>
+        <description/>
+        <ownerId>251839141158</ownerId>
+        <requesterManaged>false</requesterManaged>
+        <status>available</status>
+        <macAddress>02:74:b0:72:79:61</macAddress>
+        <privateIpAddress>10.0.2.157</privateIpAddress>
+        <sourceDestCheck>true</sourceDestCheck>
+        <groupSet>
+            <item>
+                <groupId>sg-1a2b3c4d</groupId>
+                <groupName>default</groupName>
+            </item>
+        </groupSet>
+        <tagSet/>
+        <privateIpAddressesSet>
+            <item>
+                <privateIpAddress>10.0.2.157</privateIpAddress>
+                <primary>true</primary>
+            </item>
+        </privateIpAddressesSet>
+    </networkInterface>
+</CreateNetworkInterfaceResponse>
+`
+
+// http://goo.gl/MC1yOj
+var DeleteNetworkInterfaceExample = `
+<DeleteNetworkInterfaceResponse xmlns="http://ec2.amazonaws.com/doc/2013-10-15/">
+    <requestId>e1c6d73b-edaa-4e62-9909-6611404e1739</requestId>
+    <return>true</return>
+</DeleteNetworkInterfaceResponse>
+`
+
+// http://goo.gl/2LcXtM
+var DescribeNetworkInterfacesExample = `
+<DescribeNetworkInterfacesResponse xmlns="http://ec2.amazonaws.com/doc/2013-10-15/">
+    <requestId>fc45294c-006b-457b-bab9-012f5b3b0e40</requestId>
+     <networkInterfaceSet>
+       <item>
+         <networkInterfaceId>eni-0f62d866</networkInterfaceId>
+         <subnetId>subnet-c53c87ac</subnetId>
+         <vpcId>vpc-cc3c87a5</vpcId>
+         <availabilityZone>ap-southeast-1b</availabilityZone>
+         <description/>
+         <ownerId>053230519467</ownerId>
+         <requesterManaged>false</requesterManaged>
+         <status>in-use</status>
+         <macAddress>02:81:60:cb:27:37</macAddress>
+         <privateIpAddress>10.0.0.146</privateIpAddress>
+         <sourceDestCheck>true</sourceDestCheck>
+         <groupSet>
+           <item>
+             <groupId>sg-3f4b5653</groupId>
+             <groupName>default</groupName>
+           </item>
+         </groupSet>
+         <attachment>
+           <attachmentId>eni-attach-6537fc0c</attachmentId>
+           <instanceId>i-22197876</instanceId>
+           <instanceOwnerId>053230519467</instanceOwnerId>
+           <deviceIndex>0</deviceIndex>
+           <status>attached</status>
+           <attachTime>2012-07-01T21:45:27.000Z</attachTime>
+           <deleteOnTermination>true</deleteOnTermination>
+         </attachment>
+         <tagSet/>
+         <privateIpAddressesSet>
+           <item>
+             <privateIpAddress>10.0.0.146</privateIpAddress>
+             <primary>true</primary>
+           </item>
+           <item>
+             <privateIpAddress>10.0.0.148</privateIpAddress>
+             <primary>false</primary>
+           </item>
+           <item>
+             <privateIpAddress>10.0.0.150</privateIpAddress>
+             <primary>false</primary>
+           </item>
+         </privateIpAddressesSet>
+       </item>
+       <item>
+         <networkInterfaceId>eni-a66ed5cf</networkInterfaceId>
+         <subnetId>subnet-cd8a35a4</subnetId>
+         <vpcId>vpc-f28a359b</vpcId>
+         <availabilityZone>ap-southeast-1b</availabilityZone>
+         <description>Primary network interface</description>
+         <ownerId>053230519467</ownerId>
+         <requesterManaged>false</requesterManaged>
+         <status>in-use</status>
+         <macAddress>02:78:d7:00:8a:1e</macAddress>
+         <privateIpAddress>10.0.1.233</privateIpAddress>
+         <sourceDestCheck>true</sourceDestCheck>
+         <groupSet>
+           <item>
+             <groupId>sg-a2a0b2ce</groupId>
+             <groupName>quick-start-1</groupName>
+           </item>
+         </groupSet>
+         <attachment>
+           <attachmentId>eni-attach-a99c57c0</attachmentId>
+           <instanceId>i-886401dc</instanceId>
+           <instanceOwnerId>053230519467</instanceOwnerId>
+           <deviceIndex>0</deviceIndex>
+           <status>attached</status>
+           <attachTime>2012-06-27T20:08:44.000Z</attachTime>
+           <deleteOnTermination>true</deleteOnTermination>
+         </attachment>
+         <tagSet/>
+         <privateIpAddressesSet>
+           <item>
+             <privateIpAddress>10.0.1.233</privateIpAddress>
+             <primary>true</primary>
+           </item>
+           <item>
+             <privateIpAddress>10.0.1.20</privateIpAddress>
+             <primary>false</primary>
+           </item>
+         </privateIpAddressesSet>
+       </item>
+     </networkInterfaceSet>
+</DescribeNetworkInterfacesResponse>
+`
+
+// http://goo.gl/rEbSii
+var AttachNetworkInterfaceExample = `
+<AttachNetworkInterfaceResponse xmlns="http://ec2.amazonaws.com/doc/2013-10-15/">
+    <requestId>ace8cd1e-e685-4e44-90fb-92014d907212</requestId>
+    <attachmentId>eni-attach-d94b09b0</attachmentId>
+</AttachNetworkInterfaceResponse>
+`
+
+// http://goo.gl/0Xc1px
+var DetachNetworkInterfaceExample = `
+<DetachNetworkInterfaceResponse xmlns="http://ec2.amazonaws.com/doc/2013-10-15/">
+    <requestId>ce540707-0635-46bc-97da-33a8a362a0e8</requestId>
+    <return>true</return>
+</DetachNetworkInterfaceResponse>
+`

=== modified file 'ec2/subnets_test.go'
--- ec2/subnets_test.go	2014-02-07 12:56:14 +0000
+++ ec2/subnets_test.go	2014-02-07 12:56:14 +0000
@@ -91,7 +91,7 @@
 	c.Check(subnet.Tags, HasLen, 0)
 }
 
-// Subnet tests run against either a local test server or live on EC2.
+// Subnet tests to run against either a local test server or live on EC2.
 
 func (s *ServerTests) TestSubnets(c *C) {
 	resp, err := s.ec2.CreateVPC("10.2.0.0/16", "")
@@ -99,30 +99,7 @@
 	vpcId := resp.VPC.Id
 	defer s.deleteVPCs(c, []string{vpcId})
 
-	// It might take some time for the VPC to get created, so we need
-	// to retry a few times when running against the EC2 servers.
-	var resp1 *ec2.CreateSubnetResp
-	testAttempt := aws.AttemptStrategy{
-		Total: 2 * time.Minute,
-		Delay: 5 * time.Second,
-	}
-	done := false
-	for a := testAttempt.Start(); a.Next(); {
-		resp1, err = s.ec2.CreateSubnet(vpcId, "10.2.1.0/24", "")
-		if s.errorCode(err) == "InvalidVpcID.NotFound" {
-			c.Logf("VPC %v not created yet; retrying", vpcId)
-			continue
-		}
-		if err != nil {
-			c.Logf("retrying; CreateSubnet returned: %v", err)
-			continue
-		}
-		done = true
-		break
-	}
-	if !done {
-		c.Fatalf("timeout while waiting for VPC and subnet")
-	}
+	resp1 := s.createSubnet(c, vpcId, "10.2.1.0/24", "")
 	assertSubnet(c, resp1.Subnet, "", vpcId, "10.2.1.0/24")
 	id1 := resp1.Subnet.Id
 
@@ -136,8 +113,12 @@
 	// servers). In some cases it takes a short while until both
 	// subnets are created, so we need to retry a few times to make
 	// sure.
+	testAttempt := aws.AttemptStrategy{
+		Total: 2 * time.Minute,
+		Delay: 5 * time.Second,
+	}
 	var list *ec2.SubnetsResp
-	done = false
+	done := false
 	for a := testAttempt.Start(); a.Next(); {
 		c.Logf("waiting for %v to be created", []string{id1, id2})
 		list, err = s.ec2.Subnets(nil, nil)
@@ -188,6 +169,62 @@
 	c.Assert(err, IsNil)
 }
 
+// createSubnet ensures a subnet with the given vpcId and cidrBlock
+// gets created, retrying a few times with a timeout. This needs to be
+// done when testing against EC2 servers, because if the VPC was just
+// created it might take some time for it to show up, so the subnet
+// can be created.
+func (s *ServerTests) createSubnet(c *C, vpcId, cidrBlock, availZone string) *ec2.CreateSubnetResp {
+	testAttempt := aws.AttemptStrategy{
+		Total: 2 * time.Minute,
+		Delay: 5 * time.Second,
+	}
+	for a := testAttempt.Start(); a.Next(); {
+		resp, err := s.ec2.CreateSubnet(vpcId, cidrBlock, availZone)
+		if s.errorCode(err) == "InvalidVpcID.NotFound" {
+			c.Logf("VPC %v not created yet; retrying", vpcId)
+			continue
+		}
+		if err != nil {
+			c.Logf("retrying; CreateSubnet returned: %v", err)
+			continue
+		}
+		return resp
+	}
+	c.Fatalf("timeout while waiting for VPC and subnet")
+	return nil
+}
+
+// deleteSubnets ensures the given subnets are deleted, by retrying
+// until a timeout or all subnets cannot be found anymore.  This
+// should be used to make sure tests leave no subnets around.
+func (s *ServerTests) deleteSubnets(c *C, ids []string) {
+	testAttempt := aws.AttemptStrategy{
+		Total: 2 * time.Minute,
+		Delay: 5 * time.Second,
+	}
+	for a := testAttempt.Start(); a.Next(); {
+		deleted := 0
+		c.Logf("deleting subnets %v", ids)
+		for _, id := range ids {
+			_, err := s.ec2.DeleteSubnet(id)
+			if err == nil || s.errorCode(err) == "InvalidSubnetID.NotFound" {
+				c.Logf("subnet %s deleted", id)
+				deleted++
+				continue
+			}
+			if err != nil {
+				c.Logf("retrying; DeleteSubnet returned: %v", err)
+			}
+		}
+		if deleted == len(ids) {
+			c.Logf("all subnets deleted")
+			return
+		}
+	}
+	c.Fatalf("timeout while waiting %v subnets to get deleted!", ids)
+}
+
 func assertSubnet(c *C, obtained ec2.Subnet, expectId, expectVpcId, expectCidr string) {
 	if expectId != "" {
 		c.Check(obtained.Id, Equals, expectId)