Merge lp:~dimitern/goamz/vpc-instance-addons into lp:goamz

[Dimiter Naydenov]

ec2: Added NIC support for RunInstances

This extends RunInstances options to include
a list of NetworkInterfaceSpec options. They
allow specifying NICs to attach to instances
at launch time (either existing or new NICs).

It also adds SubnetId, VPCId, SourceDestCheck,
and NetworkInterfaces fields to the Instance
type, so Instances() and RunInstances() can
return the extended VPC-related information
for an instance.

If any NetworkInterfaceSpec options are provided,
or SubnetID is given, RunInstances() will use the
latest AWS API version (2013-10-15), otherwise it
uses the default version (2011-12-15).

Modified terminateInstances() test helper to wait
and retry when running against live EC2 servers,
to make sure the instances are really gone and
not left hanging after the test (leaking related
resources with them). In order for this to work
with the local testing server, a slight change
was made - when an instance is terminated, the
next time you fetch it with Instances(), it will
report "terminated" (thus simulating the real
state transition).

Added vpc-id and subnet-id filters to ec2test's
Instance and securityGroup types, and also changed
TestGroupFiltering and TestInstanceFiltering to
include tests for them.

Test double changed to support VPC security groups
and verify subnet ID in runInstances, as EC2 does.
Added NewInstancesVPC() method with vpcId and subnetId,
so VPC-enabled instances can be created in the test
server.

Added a TestRunInstancesVPC live test for the new
functionality (only live, because it's not worth
it to change the test double to create NICs in
runInstances()).

https://codereview.appspot.com/60620043/

[Dimiter Naydenov (dimitern)]

Reviewers: mp+205148_code.launchpad.net,

Message:
Please take a look.

Description:
ec2: Added NIC support for RunInstances

This extends RunInstances options to include
a list of NetworkInterfaceSpec options. They
allow specifying NICs to attach to instances
at launch time (either existing or new NICs).

It also adds SubnetId, VPCId, SourceDestCheck,
and NetworkInterfaces fields to the Instance
type, so Instances() and RunInstances() can
return the extended VPC-related information
for an instance.

If any NetworkInterfaceSpec options are provided,
RunInstances() will use the latest AWS API version
(2013-10-15), otherwise it uses the default version
(2011-12-15).

Modified terminateInstances() test helper to wait
and retry when running against live EC2 servers,
to make sure the instances are really gone and
not left hanging after the test (leaking related
resources with them). In order for this to work
with the local testing server, a slight change
was made - when an instance is terminated, the
next time you fetch it with Instances(), it will
report "terminated" (thus simulating the real
state transition).

Added vpc-id and subnet-id filters to ec2test's
Instance and securityGroup types, and also changed
TestGroupFiltering and TestInstanceFiltering to
include tests for them.

Test double changed to support VPC security groups
and verify subnet ID in runInstances, as EC2 does.
NewInstances() interface changed to include a
vpcId and subnetId (both optional), so VPC-enabled
instances can be created in the test server.

https://code.launchpad.net/~dimitern/goamz/vpc-instance-addons/+merge/205148

Requires:
https://code.launchpad.net/~dimitern/goamz/nic-api-calls/+merge/204912

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/60620043/

Affected files (+407, -59 lines):
   A [revision details]
   M ec2/ec2.go
   M ec2/ec2_test.go
   M ec2/ec2t_test.go
   M ec2/ec2test/server.go
   M ec2/networkinterfaces_test.go
   M ec2/responses_test.go

[lp:~dimitern/goamz/vpc-instance-addons]

59. By Dimiter Naydenov on 2014-02-06

Removed test import; Added TestRunInstancesVPC live test

[Dimiter Naydenov (dimitern)]

Please take a look.

https://codereview.appspot.com/60620043/

[Roger Peppe (rogpeppe)]

LGTM with some suggestions below.

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2.go
File ec2/ec2.go (right):

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2.go#newcode299
ec2/ec2.go:299: // given, a VPC-enabled instances will be started.
Cannot specify
s/instances/instance/

But this whole paragraph is a bit hard to read.
Can't we just leave it out and let the user
get the gory details from the amz docs, like
most of the other params?

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2t_test.go
File ec2/ec2t_test.go (right):

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2t_test.go#newcode141
ec2/ec2t_test.go:141: c.Check(err, IsNil, Commentf("%d INSTANCES LEFT
RUNNING!!!", len(ids)))
Do we really need to fail the test if we can't terminate the instances
immediately?

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2t_test.go#newcode164
ec2/ec2t_test.go:164: idsLeft[inst.InstanceId] = false
if you did:

     delete(idsLeft, inst.InstanceId)

you wouldn't need the

     if left {

test in the range loop below.

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2t_test.go#newcode653
ec2/ec2t_test.go:653: // some of the reset depend on it, so they can't
be deleted before
s/the some of the reset/some of the rest/ ?

I don't understand how the comment applies to the statement
though - g[0] is first in the deleteGroups call, not g[3].

https://codereview.appspot.com/60620043/

[lp:~dimitern/goamz/vpc-instance-addons]

60. By Dimiter Naydenov on 2014-02-06

Fixed a test

61. By Dimiter Naydenov on 2014-02-06

Changes after reivew

[Dimiter Naydenov (dimitern)]

Please take a look.

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2.go
File ec2/ec2.go (right):

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2.go#newcode299
ec2/ec2.go:299: // given, a VPC-enabled instances will be started.
Cannot specify
On 2014/02/06 14:56:14, rog wrote:
> s/instances/instance/

> But this whole paragraph is a bit hard to read.
> Can't we just leave it out and let the user
> get the gory details from the amz docs, like
> most of the other params?

Done.

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2t_test.go
File ec2/ec2t_test.go (right):

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2t_test.go#newcode141
ec2/ec2t_test.go:141: c.Check(err, IsNil, Commentf("%d INSTANCES LEFT
RUNNING!!!", len(ids)))
On 2014/02/06 14:56:14, rog wrote:
> Do we really need to fail the test if we can't terminate the instances
> immediately?

Yes we do! We depend on TerminateInstances being successful. If it
returns an error there's no point in the loop below. I even changed it
to Assert, so this more obvious.

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2t_test.go#newcode164
ec2/ec2t_test.go:164: idsLeft[inst.InstanceId] = false
On 2014/02/06 14:56:14, rog wrote:
> if you did:

> delete(idsLeft, inst.InstanceId)

> you wouldn't need the

> if left {

> test in the range loop below.

Done.

https://codereview.appspot.com/60620043/diff/20001/ec2/ec2t_test.go#newcode653
ec2/ec2t_test.go:653: // some of the reset depend on it, so they can't
be deleted before
On 2014/02/06 14:56:14, rog wrote:
> s/the some of the reset/some of the rest/ ?

> I don't understand how the comment applies to the statement
> though - g[0] is first in the deleteGroups call, not g[3].

By "first" I meant "first of the set g[3], g[1], g[2]". I'll rephrase.

https://codereview.appspot.com/60620043/

[lp:~dimitern/goamz/vpc-instance-addons]

62. By Dimiter Naydenov on 2014-02-07

Merged nic-api-calls into vpc-instance-addons.

63. By Dimiter Naydenov on 2014-02-07

Merged nic-api-calls into vpc-instance-addons.

64. By Dimiter Naydenov on 2014-02-07

Merged nic-api-calls into vpc-instance-addons.

[Dimiter Naydenov (dimitern)]

Please take a look.

https://codereview.appspot.com/60620043/

[Gustavo Niemeyer (niemeyer)]

LGTM, but please ask for at least one more review.

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go
File ec2/ec2.go (right):

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go#newcode232
ec2/ec2.go:232: SecondaryPrivateIPsCount int
s/IPsCount/IPCount/, as per the previous point?

https://codereview.appspot.com/60620043/

[Gustavo Niemeyer (niemeyer)]

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go
File ec2/ec2.go (right):

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go#newcode204
ec2/ec2.go:204: // NetworkInterfaceSpec encapsulates options for a
single network
Ah, and as we discussed, this type should be something along the lines
of

     RunNetworkInterface

It's an unfortunate name, but I cannot come up with anything better that
is not absurdly long.

For the record, the generic name "NetworkInterfaceSpec" sounds like a
problem because this is actually a set of options that only really make
sense in the specific context of RunInstances. We already have another
bag of data that only really makes sense in the context of
CreateNetworkInterface. If we need one more, will we name it
NetworkInterface..Data?..Stuff?

https://codereview.appspot.com/60620043/

[Nate Finch (natefinch)]

LGTM, just a couple nice-to-have changes

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go
File ec2/ec2.go (right):

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go#newcode305
ec2/ec2.go:305: if options.SubnetId != "" ||
len(options.NetworkInterfaces) > 0 {
I'd like to have this extracted into a standalone function so it can be
tested by itself.

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go#newcode362
ec2/ec2.go:362: for i, ni := range options.NetworkInterfaces {
I'd really prefer if the internals to this and the loop above were
factored out into separate functions. I know you didn't write the loop
above, but it would cut down on the size of this already pretty large
function.

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2t_test.go
File ec2/ec2t_test.go (right):

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2t_test.go#newcode141
ec2/ec2t_test.go:141: c.Assert(err, IsNil, Commentf("%d INSTANCES LEFT
RUNNING!!!", ids))
either len(ids) or %v here, right?

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2t_test.go#newcode146
ec2/ec2t_test.go:146: Total: 10 * time.Minute,
do we really want tests that might wait 10 minutes?

https://codereview.appspot.com/60620043/

[Dimiter Naydenov (dimitern)]

*** Submitted:

ec2: Added NIC support for RunInstances

This extends RunInstances options to include
a list of NetworkInterfaceSpec options. They
allow specifying NICs to attach to instances
at launch time (either existing or new NICs).

It also adds SubnetId, VPCId, SourceDestCheck,
and NetworkInterfaces fields to the Instance
type, so Instances() and RunInstances() can
return the extended VPC-related information
for an instance.

If any NetworkInterfaceSpec options are provided,
or SubnetID is given, RunInstances() will use the
latest AWS API version (2013-10-15), otherwise it
uses the default version (2011-12-15).

Modified terminateInstances() test helper to wait
and retry when running against live EC2 servers,
to make sure the instances are really gone and
not left hanging after the test (leaking related
resources with them). In order for this to work
with the local testing server, a slight change
was made - when an instance is terminated, the
next time you fetch it with Instances(), it will
report "terminated" (thus simulating the real
state transition).

Added vpc-id and subnet-id filters to ec2test's
Instance and securityGroup types, and also changed
TestGroupFiltering and TestInstanceFiltering to
include tests for them.

Test double changed to support VPC security groups
and verify subnet ID in runInstances, as EC2 does.
Added NewInstancesVPC() method with vpcId and subnetId,
so VPC-enabled instances can be created in the test
server.

Added a TestRunInstancesVPC live test for the new
functionality (only live, because it's not worth
it to change the test double to create NICs in
runInstances()).

R=rog, niemeyer, nate.finch
CC=
https://codereview.appspot.com/60620043

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go
File ec2/ec2.go (right):

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go#newcode204
ec2/ec2.go:204: // NetworkInterfaceSpec encapsulates options for a
single network
On 2014/02/12 14:52:17, niemeyer wrote:
> Ah, and as we discussed, this type should be something along the lines
of

> RunNetworkInterface

> It's an unfortunate name, but I cannot come up with anything better
that is not
> absurdly long.

> For the record, the generic name "NetworkInterfaceSpec" sounds like a
problem
> because this is actually a set of options that only really make sense
in the
> specific context of RunInstances. We already have another bag of data
that only
> really makes sense in the context of CreateNetworkInterface. If we
need one
> more, will we name it NetworkInterface..Data?..Stuff?

Done.

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go#newcode232
ec2/ec2.go:232: SecondaryPrivateIPsCount int
On 2014/02/12 14:49:53, niemeyer wrote:
> s/IPsCount/IPCount/, as per the previous point?

Done.

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go#newcode305
ec2/ec2.go:305: if options.SubnetId != "" ||
len(options.NetworkInterfaces) > 0 {
On 2014/02/12 16:26:29, nate.finch wrote:
> I'd like to have this extracted into a standalone function so it can
be tested
> by itself.

Extracted and added a test.

https://codereview.appspot.com/60620043/diff/60001/ec2/ec2.go#newcode362
ec2/ec2.g...

[Dimiter Naydenov (dimitern)]

Post-submit approval.

review: Approve

=== modified file 'ec2/ec2.go'
--- ec2/ec2.go	2014-02-07 12:59:16 +0000
+++ ec2/ec2.go	2014-02-07 12:59:16 +0000
@@ -201,6 +201,37 @@
 // ----------------------------------------------------------------------------
 // Instance management functions and types.
 
+// NetworkInterfaceSpec encapsulates options for a single network
+// interface, specified when calling RunInstances.
+//
+// If Id is set, it must match an existing VPC network interface, and
+// in this case only a single instance can be launched. If Id is not
+// set, a new network interface will be created for each instance.
+//
+// The following fields are required when creating a new network
+// interface (i.e. Id is empty): DeviceIndex, SubnetId, Description
+// (only used if set), SecurityGroupIds.
+//
+// PrivateIPs can be used to add one or more private IP addresses to a
+// network interface. Only one of the IP addresses can be set as
+// primary. If none are given, EC2 selects a primary IP for each
+// created interface from the subnet pool.
+//
+// When SecondaryPrivateIPsCount is non-zero, EC2 allocates that
+// number of IP addresses from within the subnet range and sets them
+// as secondary IPs. The number of IP addresses you can assign to a
+// network interface varies by instance type.
+type NetworkInterfaceSpec struct {
+	Id                       string
+	DeviceIndex              int
+	SubnetId                 string
+	Description              string
+	PrivateIPs               []PrivateIP
+	SecurityGroupIds         []string
+	DeleteOnTermination      bool
+	SecondaryPrivateIPsCount int
+}
+
 // The RunInstances type encapsulates options for the respective request in EC2.
 //
 // See http://goo.gl/Mcm3b for more details.
@@ -222,6 +253,7 @@
 	ShutdownBehavior      string
 	PrivateIPAddress      string
 	BlockDeviceMappings   []BlockDeviceMapping
+	NetworkInterfaces     []NetworkInterfaceSpec
 }
 
 // Response to a RunInstances request.
@@ -239,33 +271,44 @@
 //
 // See http://goo.gl/OCH8a for more details.
 type Instance struct {
-	InstanceId         string          `xml:"instanceId"`
-	InstanceType       string          `xml:"instanceType"`
-	ImageId            string          `xml:"imageId"`
-	PrivateDNSName     string          `xml:"privateDnsName"`
-	DNSName            string          `xml:"dnsName"`
-	IPAddress          string          `xml:"ipAddress"`
-	PrivateIPAddress   string          `xml:"privateIpAddress"`
-	KeyName            string          `xml:"keyName"`
-	AMILaunchIndex     int             `xml:"amiLaunchIndex"`
-	Hypervisor         string          `xml:"hypervisor"`
-	VirtType           string          `xml:"virtualizationType"`
-	Monitoring         string          `xml:"monitoring>state"`
-	AvailZone          string          `xml:"placement>availabilityZone"`
-	PlacementGroupName string          `xml:"placement>groupName"`
-	State              InstanceState   `xml:"instanceState"`
-	Tags               []Tag           `xml:"tagSet>item"`
-	SecurityGroups     []SecurityGroup `xml:"groupSet>item"`
+	InstanceId         string             `xml:"instanceId"`
+	InstanceType       string             `xml:"instanceType"`
+	ImageId            string             `xml:"imageId"`
+	PrivateDNSName     string             `xml:"privateDnsName"`
+	DNSName            string             `xml:"dnsName"`
+	IPAddress          string             `xml:"ipAddress"`
+	PrivateIPAddress   string             `xml:"privateIpAddress"`
+	SubnetId           string             `xml:"subnetId"`
+	VPCId              string             `xml:"vpcId"`
+	SourceDestCheck    bool               `xml:"sourceDestCheck"`
+	KeyName            string             `xml:"keyName"`
+	AMILaunchIndex     int                `xml:"amiLaunchIndex"`
+	Hypervisor         string             `xml:"hypervisor"`
+	VirtType           string             `xml:"virtualizationType"`
+	Monitoring         string             `xml:"monitoring>state"`
+	AvailZone          string             `xml:"placement>availabilityZone"`
+	PlacementGroupName string             `xml:"placement>groupName"`
+	State              InstanceState      `xml:"instanceState"`
+	Tags               []Tag              `xml:"tagSet>item"`
+	SecurityGroups     []SecurityGroup    `xml:"groupSet>item"`
+	NetworkInterfaces  []NetworkInterface `xml:"networkInterfaceSet>item"`
 }
 
 // RunInstances starts new instances in EC2.
 // If options.MinCount and options.MaxCount are both zero, a single instance
 // will be started; otherwise if options.MaxCount is zero, options.MinCount
-// will be used insteead.
+// will be used instead.
 //
 // See http://goo.gl/Mcm3b for more details.
 func (ec2 *EC2) RunInstances(options *RunInstances) (resp *RunInstancesResp, err error) {
-	params := makeParams("RunInstances")
+	var params map[string]string
+	if options.SubnetId != "" || len(options.NetworkInterfaces) > 0 {
+		// When either SubnetId or NetworkInterfaces are specified, we
+		// need to use the API version with complete VPC support.
+		params = makeParamsVPC("RunInstances")
+	} else {
+		params = makeParams("RunInstances")
+	}
 	params["ImageId"] = options.ImageId
 	params["InstanceType"] = options.InstanceType
 	var min, max int
@@ -293,26 +336,61 @@
 	}
 	for i, b := range options.BlockDeviceMappings {
 		n := strconv.Itoa(i + 1)
+		prefix := "BlockDeviceMapping." + n
 		if b.DeviceName != "" {
-			params["BlockDeviceMapping."+n+".DeviceName"] = b.DeviceName
+			params[prefix+".DeviceName"] = b.DeviceName
 		}
 		if b.VirtualName != "" {
-			params["BlockDeviceMapping."+n+".VirtualName"] = b.VirtualName
+			params[prefix+".VirtualName"] = b.VirtualName
 		}
 		if b.SnapshotId != "" {
-			params["BlockDeviceMapping."+n+".Ebs.SnapshotId"] = b.SnapshotId
+			params[prefix+".Ebs.SnapshotId"] = b.SnapshotId
 		}
 		if b.VolumeType != "" {
-			params["BlockDeviceMapping."+n+".Ebs.VolumeType"] = b.VolumeType
+			params[prefix+".Ebs.VolumeType"] = b.VolumeType
 		}
 		if b.VolumeSize > 0 {
-			params["BlockDeviceMapping."+n+".Ebs.VolumeSize"] = strconv.FormatInt(b.VolumeSize, 10)
+			params[prefix+".Ebs.VolumeSize"] = strconv.FormatInt(b.VolumeSize, 10)
 		}
 		if b.IOPS > 0 {
-			params["BlockDeviceMapping."+n+".Ebs.Iops"] = strconv.FormatInt(b.IOPS, 10)
+			params[prefix+".Ebs.Iops"] = strconv.FormatInt(b.IOPS, 10)
 		}
 		if b.DeleteOnTermination {
-			params["BlockDeviceMapping."+n+".Ebs.DeleteOnTermination"] = "true"
+			params[prefix+".Ebs.DeleteOnTermination"] = "true"
+		}
+	}
+	for i, ni := range options.NetworkInterfaces {
+		// Unlike other lists, NetworkInterface and PrivateIpAddresses
+		// should start from 0, not 1, according to the examples
+		// requests in the API documentation here http://goo.gl/Mcm3b.
+		n := strconv.Itoa(i)
+		prefix := "NetworkInterface." + n
+		if ni.Id != "" {
+			params[prefix+".NetworkInterfaceId"] = ni.Id
+		}
+		params[prefix+".DeviceIndex"] = strconv.Itoa(ni.DeviceIndex)
+		if ni.SubnetId != "" {
+			params[prefix+".SubnetId"] = ni.SubnetId
+		}
+		if ni.Description != "" {
+			params[prefix+".Description"] = ni.Description
+		}
+		for j, gid := range ni.SecurityGroupIds {
+			k := strconv.Itoa(j + 1)
+			params[prefix+".SecurityGroupId."+k] = gid
+		}
+		if ni.DeleteOnTermination {
+			params[prefix+".DeleteOnTermination"] = "true"
+		}
+		if ni.SecondaryPrivateIPsCount > 0 {
+			val := strconv.Itoa(ni.SecondaryPrivateIPsCount)
+			params[prefix+".SecondaryPrivateIpAddressCount"] = val
+		}
+		for j, ip := range ni.PrivateIPs {
+			k := strconv.Itoa(j)
+			subprefix := prefix + ".PrivateIpAddresses." + k
+			params[subprefix+".PrivateIpAddress"] = ip.Address
+			params[subprefix+".Primary"] = strconv.FormatBool(ip.IsPrimary)
 		}
 	}
 	token, err := clientToken()

=== modified file 'ec2/ec2_test.go'
--- ec2/ec2_test.go	2014-02-07 12:59:16 +0000
+++ ec2/ec2_test.go	2014-02-07 12:59:16 +0000
@@ -105,6 +105,27 @@
 			DeleteOnTermination: true,
 			IOPS:                1000,
 		}},
+		NetworkInterfaces: []ec2.NetworkInterfaceSpec{{
+			DeviceIndex: 0,
+			SubnetId:    "subnet-id",
+			Description: "eth0",
+			PrivateIPs: []ec2.PrivateIP{
+				{Address: "10.0.0.25", IsPrimary: true},
+			},
+			DeleteOnTermination:      true,
+			SecurityGroupIds:         []string{"sg-1", "sg-2"},
+			SecondaryPrivateIPsCount: 2,
+		}, {
+			Id:          "eni-id",
+			DeviceIndex: 1,
+			PrivateIPs: []ec2.PrivateIP{{
+				Address:   "10.0.1.10",
+				IsPrimary: true,
+			}, {
+				Address:   "10.0.1.20",
+				IsPrimary: false,
+			}},
+		}},
 	}
 	resp, err := s.ec2.RunInstances(&options)
 
@@ -136,6 +157,19 @@
 	c.Assert(req.Form["BlockDeviceMapping.1.Ebs.VolumeSize"], DeepEquals, []string{"10"})
 	c.Assert(req.Form["BlockDeviceMapping.1.Ebs.Iops"], DeepEquals, []string{"1000"})
 	c.Assert(req.Form["BlockDeviceMapping.1.Ebs.DeleteOnTermination"], DeepEquals, []string{"true"})
+	c.Assert(req.Form["NetworkInterface.0.DeviceIndex"], DeepEquals, []string{"0"})
+	c.Assert(req.Form["NetworkInterface.0.SubnetId"], DeepEquals, []string{"subnet-id"})
+	c.Assert(req.Form["NetworkInterface.0.Description"], DeepEquals, []string{"eth0"})
+	c.Assert(req.Form["NetworkInterface.0.SecurityGroupId.1"], DeepEquals, []string{"sg-1"})
+	c.Assert(req.Form["NetworkInterface.0.SecurityGroupId.2"], DeepEquals, []string{"sg-2"})
+	c.Assert(req.Form["NetworkInterface.0.DeleteOnTermination"], DeepEquals, []string{"true"})
+	c.Assert(req.Form["NetworkInterface.0.SecondaryPrivateIpAddressCount"], DeepEquals, []string{"2"})
+	c.Assert(req.Form["NetworkInterface.1.NetworkInterfaceId"], DeepEquals, []string{"eni-id"})
+	c.Assert(req.Form["NetworkInterface.1.DeviceIndex"], DeepEquals, []string{"1"})
+	c.Assert(req.Form["NetworkInterface.1.PrivateIpAddresses.0.PrivateIpAddress"], DeepEquals, []string{"10.0.1.10"})
+	c.Assert(req.Form["NetworkInterface.1.PrivateIpAddresses.0.Primary"], DeepEquals, []string{"true"})
+	c.Assert(req.Form["NetworkInterface.1.PrivateIpAddresses.1.PrivateIpAddress"], DeepEquals, []string{"10.0.1.20"})
+	c.Assert(req.Form["NetworkInterface.1.PrivateIpAddresses.1.Primary"], DeepEquals, []string{"false"})
 
 	c.Assert(err, IsNil)
 	c.Assert(resp.RequestId, Equals, "59dbff89-35bd-4eac-99ed-be587EXAMPLE")
@@ -153,6 +187,53 @@
 	c.Assert(i0.AMILaunchIndex, Equals, 0)
 	c.Assert(i0.VirtType, Equals, "paravirtual")
 	c.Assert(i0.Hypervisor, Equals, "xen")
+	c.Assert(i0.SubnetId, Equals, "subnet-id")
+	c.Assert(i0.VPCId, Equals, "vpc-id")
+	c.Assert(i0.NetworkInterfaces, HasLen, 2)
+	c.Assert(i0.NetworkInterfaces, DeepEquals, []ec2.NetworkInterface{{
+		Id:              "eni-c6bb50ae",
+		SubnetId:        "subnet-id",
+		VPCId:           "vpc-id",
+		Description:     "eth0",
+		SourceDestCheck: true,
+		OwnerId:         "111122223333",
+		Status:          "in-use",
+		Groups: []ec2.SecurityGroup{
+			{Name: "vpc sg-1", Id: "sg-1"},
+			{Name: "vpc sg-2", Id: "sg-2"},
+		},
+		MACAddress:       "11:22:33:44:55:66",
+		PrivateIPAddress: "10.0.0.25",
+		PrivateIPs:       []ec2.PrivateIP{{Address: "10.0.0.25", IsPrimary: true}},
+		Attachment: ec2.NetworkInterfaceAttachment{
+			Id:                  "eni-attach-0326646a",
+			DeviceIndex:         0,
+			Status:              "attaching",
+			AttachTime:          "2011-12-20T08:29:31.000Z",
+			DeleteOnTermination: true,
+		},
+	}, {
+		Id:               "eni-id",
+		SubnetId:         "subnet-id",
+		VPCId:            "vpc-id",
+		SourceDestCheck:  true,
+		OwnerId:          "111122223333",
+		Status:           "in-use",
+		Groups:           []ec2.SecurityGroup{{Name: "vpc default", Id: "sg-id"}},
+		MACAddress:       "11:22:33:44:55:66",
+		PrivateIPAddress: "10.0.1.10",
+		PrivateIPs: []ec2.PrivateIP{
+			{Address: "10.0.1.10", IsPrimary: true},
+			{Address: "10.0.1.20", IsPrimary: false},
+		},
+		Attachment: ec2.NetworkInterfaceAttachment{
+			Id:                  "eni-attach-id",
+			DeviceIndex:         1,
+			Status:              "attaching",
+			AttachTime:          "2011-12-20T08:29:31.000Z",
+			DeleteOnTermination: false,
+		},
+	}})
 
 	i1 := resp.Instances[1]
 	c.Assert(i1.InstanceId, Equals, "i-2bc64242")

=== modified file 'ec2/ec2t_test.go'
--- ec2/ec2t_test.go	2014-02-07 12:59:16 +0000
+++ ec2/ec2t_test.go	2014-02-07 12:59:16 +0000
@@ -136,15 +136,43 @@
 	ec2 *ec2.EC2
 }
 
-func terminateInstances(c *C, e *ec2.EC2, insts []*ec2.Instance) {
-	var ids []string
-	for _, inst := range insts {
-		if inst != nil {
-			ids = append(ids, inst.InstanceId)
-		}
-	}
+func terminateInstances(c *C, e *ec2.EC2, ids []string) {
 	_, err := e.TerminateInstances(ids)
-	c.Check(err, IsNil, Commentf("%d INSTANCES LEFT RUNNING!!!", len(ids)))
+	c.Assert(err, IsNil, Commentf("%d INSTANCES LEFT RUNNING!!!", ids))
+	// We need to wait until the instances are really off, because
+	// entities that depend on them won't be deleted (i.e. groups,
+	// NICs, subnets, etc.)
+	testAttempt := aws.AttemptStrategy{
+		Total: 10 * time.Minute,
+		Delay: 5 * time.Second,
+	}
+	f := ec2.NewFilter()
+	f.Add("instance-state-name", "terminated")
+	idsLeft := make(map[string]bool)
+	for _, id := range ids {
+		idsLeft[id] = true
+	}
+	for a := testAttempt.Start(); a.Next(); {
+		c.Logf("waiting for %v to get terminated", ids)
+		resp, err := e.Instances(ids, f)
+		if err != nil {
+			c.Fatalf("not waiting for %v to terminate: %v", ids, err)
+		}
+		for _, r := range resp.Reservations {
+			for _, inst := range r.Instances {
+				delete(idsLeft, inst.InstanceId)
+			}
+		}
+		ids = []string{}
+		for id, _ := range idsLeft {
+			ids = append(ids, id)
+		}
+		if len(ids) == 0 {
+			c.Logf("all instances terminated.")
+			return
+		}
+	}
+	c.Fatalf("%v INSTANCES LEFT RUNNING!!!", ids)
 }
 
 func (s *ServerTests) makeTestGroup(c *C, name, descr string) ec2.SecurityGroup {
@@ -313,11 +341,27 @@
 }
 
 func (s *ServerTests) TestInstanceFiltering(c *C) {
-	groupResp, err := s.ec2.CreateSecurityGroup(sessionName("testgroup1"), "testgroup one description")
+	vpcResp, err := s.ec2.CreateVPC("10.4.0.0/16", "")
+	c.Assert(err, IsNil)
+	vpcId := vpcResp.VPC.Id
+	defer s.deleteVPCs(c, []string{vpcId})
+
+	subResp := s.createSubnet(c, vpcId, "10.4.1.0/24", "")
+	subId := subResp.Subnet.Id
+	defer s.deleteSubnets(c, []string{subId})
+
+	groupResp, err := s.ec2.CreateSecurityGroup(
+		sessionName("testgroup1"),
+		"testgroup one description",
+	)
 	c.Assert(err, IsNil)
 	group1 := groupResp.SecurityGroup
 
-	groupResp, err = s.ec2.CreateSecurityGroup(sessionName("testgroup2"), "testgroup two description")
+	groupResp, err = s.ec2.CreateSecurityGroupVPC(
+		vpcId,
+		sessionName("testgroup2"),
+		"testgroup two description vpc",
+	)
 	c.Assert(err, IsNil)
 	group2 := groupResp.SecurityGroup
 
@@ -333,12 +377,12 @@
 	c.Assert(err, IsNil)
 	insts[0] = &inst.Instances[0]
 	insts[1] = &inst.Instances[1]
-	defer terminateInstances(c, s.ec2, insts)
 
 	imageId2 := "ami-e358958a" // Natty server, i386, EBS store
 	inst, err = s.ec2.RunInstances(&ec2.RunInstances{
 		ImageId:        imageId2,
 		InstanceType:   "t1.micro",
+		SubnetId:       subId,
 		SecurityGroups: []ec2.SecurityGroup{group2},
 	})
 	c.Assert(err, IsNil)
@@ -351,6 +395,8 @@
 		return
 	}
 
+	defer terminateInstances(c, s.ec2, ids(0, 1, 2))
+
 	tests := []struct {
 		about       string
 		instanceIds []string     // instanceIds argument to Instances method.
@@ -432,6 +478,13 @@
 				{"image-id", []string{imageId2}},
 				{"group-name", []string{group1.Name}},
 			},
+		}, {
+			about: "VPC filters in combination",
+			filters: []filterSpec{
+				{"vpc-id", []string{vpcId}},
+				{"subnet-id", []string{subId}},
+			},
+			resultIds: ids(2),
 		},
 	}
 	for i, t := range tests {
@@ -466,6 +519,91 @@
 	}
 }
 
+func (s *AmazonServerSuite) TestRunInstancesVPC(c *C) {
+	vpcResp, err := s.ec2.CreateVPC("10.6.0.0/16", "")
+	c.Assert(err, IsNil)
+	vpcId := vpcResp.VPC.Id
+	defer s.deleteVPCs(c, []string{vpcId})
+
+	subResp := s.createSubnet(c, vpcId, "10.6.1.0/24", "")
+	subId := subResp.Subnet.Id
+	defer s.deleteSubnets(c, []string{subId})
+
+	groupResp, err := s.ec2.CreateSecurityGroupVPC(
+		vpcId,
+		sessionName("testgroup1 vpc"),
+		"testgroup description vpc",
+	)
+	c.Assert(err, IsNil)
+	group := groupResp.SecurityGroup
+
+	defer s.deleteGroups(c, []ec2.SecurityGroup{group})
+
+	// Run a single instance with a new network interface.
+	ips := []ec2.PrivateIP{
+		{Address: "10.6.1.10", IsPrimary: true},
+		{Address: "10.6.1.20", IsPrimary: false},
+	}
+	instResp, err := s.ec2.RunInstances(&ec2.RunInstances{
+		MinCount:     1,
+		ImageId:      imageId,
+		InstanceType: "t1.micro",
+		NetworkInterfaces: []ec2.NetworkInterfaceSpec{{
+			DeviceIndex:         0,
+			SubnetId:            subId,
+			PrivateIPs:          ips,
+			SecurityGroupIds:    []string{group.Id},
+			DeleteOnTermination: true,
+		}},
+	})
+	c.Assert(err, IsNil)
+	inst := &instResp.Instances[0]
+
+	defer terminateInstances(c, s.ec2, []string{inst.InstanceId})
+
+	// Now list the network interfaces and find ours.
+	testAttempt := aws.AttemptStrategy{
+		Total: 5 * time.Minute,
+		Delay: 5 * time.Second,
+	}
+	f := ec2.NewFilter()
+	f.Add("subnet-id", subId)
+	var newNIC *ec2.NetworkInterface
+	for a := testAttempt.Start(); a.Next(); {
+		c.Logf("waiting for NIC to become available")
+		listNICs, err := s.ec2.NetworkInterfaces(nil, f)
+		if err != nil {
+			c.Logf("retrying; NetworkInterfaces returned: %v", err)
+			continue
+		}
+		for _, iface := range listNICs.Interfaces {
+			c.Logf("found NIC %v", iface)
+			if iface.Attachment.InstanceId == inst.InstanceId {
+				c.Logf("instance %v new NIC appeared", inst.InstanceId)
+				newNIC = &iface
+				break
+			}
+		}
+		if newNIC != nil {
+			break
+		}
+	}
+	if newNIC == nil {
+		c.Fatalf("timeout while waiting for NIC to appear.")
+	}
+	c.Check(newNIC.Id, Matches, `^eni-[0-9a-f]+$`)
+	c.Check(newNIC.SubnetId, Equals, subId)
+	c.Check(newNIC.VPCId, Equals, vpcId)
+	c.Check(newNIC.Status, Matches, `^(attaching|in-use)$`)
+	c.Check(newNIC.PrivateIPAddress, Equals, ips[0].Address)
+	c.Check(newNIC.PrivateIPs, DeepEquals, ips)
+	c.Check(newNIC.Groups, HasLen, 1)
+	c.Check(newNIC.Groups[0].Id, Equals, group.Id)
+	c.Check(newNIC.Attachment.Status, Matches, `^(attaching|attached)$`)
+	c.Check(newNIC.Attachment.DeviceIndex, Equals, 0)
+	c.Check(newNIC.Attachment.DeleteOnTermination, Equals, true)
+}
+
 func idsOnly(gs []ec2.SecurityGroup) []ec2.SecurityGroup {
 	for i := range gs {
 		gs[i].Name = ""
@@ -481,14 +619,37 @@
 }
 
 func (s *ServerTests) TestGroupFiltering(c *C) {
-	g := make([]ec2.SecurityGroup, 4)
+	vpcResp, err := s.ec2.CreateVPC("10.5.0.0/16", "")
+	c.Assert(err, IsNil)
+	vpcId := vpcResp.VPC.Id
+	defer s.deleteVPCs(c, []string{vpcId})
+
+	subResp := s.createSubnet(c, vpcId, "10.5.1.0/24", "")
+	subId := subResp.Subnet.Id
+	defer s.deleteSubnets(c, []string{subId})
+
+	g := make([]ec2.SecurityGroup, 5)
 	for i := range g {
-		resp, err := s.ec2.CreateSecurityGroup(sessionName(fmt.Sprintf("testgroup%d", i)), fmt.Sprintf("testdescription%d", i))
+		var resp *ec2.CreateSecurityGroupResp
+		gid := sessionName(fmt.Sprintf("testgroup%d", i))
+		desc := fmt.Sprintf("testdescription%d", i)
+		if i == 0 {
+			// Create the first one as a VPC group.
+			gid += " vpc"
+			desc += " vpc"
+			resp, err = s.ec2.CreateSecurityGroupVPC(vpcId, gid, desc)
+		} else {
+			resp, err = s.ec2.CreateSecurityGroup(gid, desc)
+		}
 		c.Assert(err, IsNil)
 		g[i] = resp.SecurityGroup
 		c.Logf("group %d: %v", i, g[i])
 	}
-	defer s.deleteGroups(c, g)
+	// Reorder the groups below, so that g[3] is first (some of the
+	// reset depend on it, so they can't be deleted before g[3]). A
+	// slight optimization for local live tests, so that we don't need
+	// to wait 5s each time deleteGroups runs.
+	defer s.deleteGroups(c, []ec2.SecurityGroup{g[3], g[0], g[1], g[2], g[4]})
 
 	perms := [][]ec2.IPPerm{
 		{{
@@ -501,17 +662,17 @@
 			Protocol:     "tcp",
 			FromPort:     200,
 			ToPort:       300,
-			SourceGroups: []ec2.UserSecurityGroup{{Id: g[1].Id}},
+			SourceGroups: []ec2.UserSecurityGroup{{Id: g[2].Id}},
 		}},
 		{{
 			Protocol:     "udp",
 			FromPort:     200,
 			ToPort:       400,
-			SourceGroups: []ec2.UserSecurityGroup{{Id: g[1].Id}},
+			SourceGroups: []ec2.UserSecurityGroup{{Id: g[2].Id}},
 		}},
 	}
 	for i, ps := range perms {
-		_, err := s.ec2.AuthorizeSecurityGroup(g[i], ps)
+		_, err := s.ec2.AuthorizeSecurityGroup(g[i+1], ps)
 		c.Assert(err, IsNil)
 	}
 
@@ -541,7 +702,7 @@
 	tests := []groupTest{
 		{
 			about:      "check that SecurityGroups returns all groups",
-			results:    groups(0, 1, 2, 3),
+			results:    groups(0, 1, 2, 3, 4),
 			allowExtra: true,
 		}, {
 			about:   "check that specifying two group ids returns them",
@@ -549,8 +710,8 @@
 			results: groups(0, 2),
 		}, {
 			about:   "check that specifying names only works",
-			groups:  namesOnly(groups(0, 2)),
-			results: groups(0, 2),
+			groups:  namesOnly(groups(1, 2)),
+			results: groups(1, 2),
 		}, {
 			about:  "check that specifying a non-existent group id gives an error",
 			groups: append(groups(0), ec2.SecurityGroup{Id: "sg-eeeeeeeee"}),
@@ -577,11 +738,12 @@
 		},
 		filterCheck("description", "testdescription1", groups(1)),
 		filterCheck("group-name", g[2].Name, groups(2)),
-		filterCheck("ip-permission.cidr", "1.2.3.4/32", groups(0)),
-		filterCheck("ip-permission.group-name", g[1].Name, groups(1, 2)),
-		filterCheck("ip-permission.protocol", "udp", groups(2)),
-		filterCheck("ip-permission.from-port", "200", groups(1, 2)),
-		filterCheck("ip-permission.to-port", "200", groups(0)),
+		filterCheck("ip-permission.cidr", "1.2.3.4/32", groups(1)),
+		filterCheck("ip-permission.group-name", g[2].Name, groups(2, 3)),
+		filterCheck("ip-permission.protocol", "udp", groups(3)),
+		filterCheck("ip-permission.from-port", "200", groups(2, 3)),
+		filterCheck("ip-permission.to-port", "200", groups(1)),
+		filterCheck("vpc-id", vpcId, groups(0)),
 		// TODO owner-id
 	}
 	for i, t := range tests {

=== modified file 'ec2/ec2test/server.go'
--- ec2/ec2test/server.go	2014-02-07 12:59:16 +0000
+++ ec2/ec2test/server.go	2014-02-07 12:59:16 +0000
@@ -85,6 +85,8 @@
 	reservation *reservation
 	instType    string
 	state       ec2.InstanceState
+	subnetId    string
+	vpcId       string
 }
 
 // permKey represents permission for a given security
@@ -150,6 +152,8 @@
 		return g.hasPerm(func(k permKey) bool { return k.protocol == value }), nil
 	case "owner-id":
 		return value == ownerId, nil
+	case "vpc-id":
+		return g.vpcId == value, nil
 	}
 	return false, fmt.Errorf("unknown attribute %q", attr)
 }
@@ -527,7 +531,6 @@
 	//    AvailZone                 ?
 	//    GroupName                 tag
 	//    Monitoring                ignore?
-	//    SubnetId                  ?
 	//    DisableAPITermination     bool
 	//    ShutdownBehavior          string
 	//    PrivateIPAddress          string
@@ -535,6 +538,16 @@
 	srv.mu.Lock()
 	defer srv.mu.Unlock()
 
+	var vpcId string
+	subnetId := req.Form.Get("SubnetId")
+	if subnetId != "" {
+		sub, found := srv.subnets[subnetId]
+		if !found {
+			fatalf(400, "InvalidSubnetID.NotFound", "subnet %s not found", subnetId)
+		}
+		vpcId = sub.VPCId
+	}
+
 	// make sure that form fields are correct before creating the reservation.
 	instType := req.Form.Get("InstanceType")
 	imageId := req.Form.Get("ImageId")
@@ -547,7 +560,7 @@
 	resp.OwnerId = ownerId
 
 	for i := 0; i < max; i++ {
-		inst := srv.newInstance(r, instType, imageId, srv.initialInstanceState)
+		inst := srv.newInstance(r, instType, imageId, srv.initialInstanceState, subnetId, vpcId)
 		inst.UserData = userData
 		resp.Instances = append(resp.Instances, inst.ec2instance())
 	}
@@ -566,10 +579,15 @@
 	return nil
 }
 
-// NewInstances creates n new instances in srv with the given instance type,
-// image ID,  initial state and security groups. If any group does not already
-// exist, it will be created. NewInstances returns the ids of the new instances.
-func (srv *Server) NewInstances(n int, instType string, imageId string, state ec2.InstanceState, groups []ec2.SecurityGroup) []string {
+// NewInstancesVPC creates n new VPC instances in srv with the given
+// instance type, image ID, initial state, and security groups,
+// belonging to the given vpcId and subnetId. If any group does not
+// already exist, it will be created. NewInstancesVPC returns the ids
+// of the new instances.
+//
+// If vpcId and subnetId are both empty, this call is equivalent to
+// calling NewInstances.
+func (srv *Server) NewInstancesVPC(vpcId, subnetId string, n int, instType string, imageId string, state ec2.InstanceState, groups []ec2.SecurityGroup) []string {
 	srv.mu.Lock()
 	defer srv.mu.Unlock()
 
@@ -585,13 +603,21 @@
 
 	ids := make([]string, n)
 	for i := 0; i < n; i++ {
-		inst := srv.newInstance(r, instType, imageId, state)
+		inst := srv.newInstance(r, instType, imageId, state, subnetId, vpcId)
 		ids[i] = inst.id()
 	}
 	return ids
 }
 
-func (srv *Server) newInstance(r *reservation, instType string, imageId string, state ec2.InstanceState) *Instance {
+// NewInstances creates n new instances in srv with the given instance
+// type, image ID, initial state, and security groups. If any group
+// does not already exist, it will be created. NewInstances returns
+// the ids of the new instances.
+func (srv *Server) NewInstances(n int, instType string, imageId string, state ec2.InstanceState, groups []ec2.SecurityGroup) []string {
+	return srv.NewInstancesVPC("", "", n, instType, imageId, state, groups)
+}
+
+func (srv *Server) newInstance(r *reservation, instType string, imageId string, state ec2.InstanceState, subnetId, vpcId string) *Instance {
 	inst := &Instance{
 		seq:         srv.maxId.next(),
 		instType:    instType,
@@ -599,6 +625,10 @@
 		state:       state,
 		reservation: r,
 	}
+	if vpcId != "" && subnetId != "" {
+		inst.vpcId = vpcId
+		inst.subnetId = subnetId
+	}
 	id := inst.id()
 	srv.instances[id] = inst
 	r.instances[id] = inst
@@ -669,6 +699,8 @@
 		IPAddress:        fmt.Sprintf("8.0.0.%d", inst.seq%256),
 		PrivateIPAddress: fmt.Sprintf("127.0.0.%d", inst.seq%256),
 		State:            inst.state,
+		VPCId:            inst.vpcId,
+		SubnetId:         inst.subnetId,
 		// TODO the rest
 	}
 }
@@ -679,6 +711,10 @@
 		return value == "i386", nil
 	case "instance-id":
 		return inst.id() == value, nil
+	case "subnet-id":
+		return inst.subnetId == value, nil
+	case "vpc-id":
+		return inst.vpcId == value, nil
 	case "instance.group-id", "group-id":
 		for _, g := range inst.reservation.groups {
 			if g.id == value {
@@ -731,6 +767,10 @@
 		id:          fmt.Sprintf("sg-%d", srv.groupId.next()),
 		perms:       make(map[permKey]bool),
 	}
+	vpcId := req.Form.Get("VpcId")
+	if vpcId != "" {
+		g.vpcId = vpcId
+	}
 	srv.groups[g.id] = g
 	// we define a local type for this because ec2.CreateSecurityGroupResp
 	// contains SecurityGroup, but the response to this request
@@ -782,6 +822,14 @@
 			if len(insts) > 0 && !insts[inst] {
 				continue
 			}
+			// make instances in state "shutting-down" to transition
+			// to "terminated" first, so we can simulate: shutdown,
+			// subsequent refresh of the state with Instances(),
+			// terminated.
+			if inst.state == ShuttingDown {
+				inst.state = Terminated
+			}
+
 			ok, err := f.ok(inst)
 			if ok {
 				instance := inst.ec2instance()

=== modified file 'ec2/networkinterfaces_test.go'
--- ec2/networkinterfaces_test.go	2014-02-07 12:59:16 +0000
+++ ec2/networkinterfaces_test.go	2014-02-07 12:59:16 +0000
@@ -214,7 +214,7 @@
 	inst := instList.Instances[0]
 	c.Assert(inst, NotNil)
 	instId := inst.InstanceId
-	defer s.ec2.TerminateInstances([]string{instId})
+	defer terminateInstances(c, s.ec2, []string{instId})
 
 	ips1 := []ec2.PrivateIP{{Address: "10.3.1.10", IsPrimary: true}}
 	resp1, err := s.ec2.CreateNetworkInterface(ec2.NetworkInterfaceOptions{

=== modified file 'ec2/responses_test.go'
--- ec2/responses_test.go	2014-02-07 12:59:16 +0000
+++ ec2/responses_test.go	2014-02-07 12:59:16 +0000
@@ -9,7 +9,7 @@
 
 // http://goo.gl/Mcm3b
 var RunInstancesExample = `
-<RunInstancesResponse xmlns="http://ec2.amazonaws.com/doc/2011-12-15/"> 
+<RunInstancesResponse xmlns="http://ec2.amazonaws.com/doc/2013-10-13/"> 
   <requestId>59dbff89-35bd-4eac-99ed-be587EXAMPLE</requestId> 
   <reservationId>r-47a5402e</reservationId> 
   <ownerId>999988887777</ownerId>
@@ -40,9 +40,82 @@
         <state>enabled</state>
       </monitoring>
       <virtualizationType>paravirtual</virtualizationType>
+      <subnetId>subnet-id</subnetId>
+      <vpcId>vpc-id</vpcId>
+      <sourceDestCheck>true</sourceDestCheck>
       <clientToken/>
       <tagSet/>
       <hypervisor>xen</hypervisor>
+      <networkInterfaceSet>
+        <item>
+          <networkInterfaceId>eni-c6bb50ae</networkInterfaceId>
+          <subnetId>subnet-id</subnetId>
+          <vpcId>vpc-id</vpcId>
+          <description>eth0</description>
+          <ownerId>111122223333</ownerId>
+          <status>in-use</status>
+          <privateIpAddress>10.0.0.25</privateIpAddress>
+          <macAddress>11:22:33:44:55:66</macAddress>
+          <sourceDestCheck>true</sourceDestCheck>
+          <groupSet>
+            <item>
+              <groupId>sg-1</groupId>
+              <groupName>vpc sg-1</groupName>
+            </item>
+            <item>
+              <groupId>sg-2</groupId>
+              <groupName>vpc sg-2</groupName>
+            </item>
+          </groupSet>
+          <attachment>
+            <attachmentId>eni-attach-0326646a</attachmentId>
+            <deviceIndex>0</deviceIndex>
+            <status>attaching</status>
+            <attachTime>2011-12-20T08:29:31.000Z</attachTime>
+            <deleteOnTermination>true</deleteOnTermination>
+          </attachment>
+          <privateIpAddressesSet>
+            <item>
+              <privateIpAddress>10.0.0.25</privateIpAddress>
+              <primary>true</primary>
+            </item>
+          </privateIpAddressesSet>
+        </item>
+        <item>
+          <networkInterfaceId>eni-id</networkInterfaceId>
+          <subnetId>subnet-id</subnetId>
+          <vpcId>vpc-id</vpcId>
+          <description/>
+          <ownerId>111122223333</ownerId>
+          <status>in-use</status>
+          <privateIpAddress>10.0.1.10</privateIpAddress>
+          <macAddress>11:22:33:44:55:66</macAddress>
+          <sourceDestCheck>true</sourceDestCheck>
+          <groupSet>
+            <item>
+              <groupId>sg-id</groupId>
+              <groupName>vpc default</groupName>
+            </item>
+          </groupSet>
+          <attachment>
+            <attachmentId>eni-attach-id</attachmentId>
+            <deviceIndex>1</deviceIndex>
+            <status>attaching</status>
+            <attachTime>2011-12-20T08:29:31.000Z</attachTime>
+            <deleteOnTermination>false</deleteOnTermination>
+          </attachment>
+          <privateIpAddressesSet>
+            <item>
+              <privateIpAddress>10.0.1.10</privateIpAddress>
+              <primary>true</primary>
+            </item>
+            <item>
+              <privateIpAddress>10.0.1.20</privateIpAddress>
+              <primary>false</primary>
+            </item>
+          </privateIpAddressesSet>
+        </item>
+      </networkInterfaceSet>
     </item>
     <item>
       <instanceId>i-2bc64242</instanceId>