diff --git a/main.tf b/main.tf
index 39b3e235..88968aa8 100644
--- a/main.tf
+++ b/main.tf
@@ -5,6 +5,10 @@ locals {
 
   is_t_instance_type = replace(var.instance_type, "/^t(2|3|3a|4g){1}\\..*$/", "1") == "1" ? true : false
 
+  network_interfaces           = var.network_interface != null ? var.network_interface : {}
+  primary_network_interface    = one([for k, v in local.network_interfaces : v if coalesce(v.device_index, k) == 0]...)
+  secondary_network_interfaces = { for k, v in local.network_interfaces : k => v if coalesce(v.device_index, k) != 0 }
+
   ami = try(coalesce(var.ami, try(nonsensitive(data.aws_ssm_parameter.this[0].value), null)), null)
 
   instance_tags = merge(
@@ -167,14 +171,10 @@ resource "aws_instance" "this" {
   monitoring = var.monitoring
 
   dynamic "network_interface" {
-    for_each = var.network_interface != null ? var.network_interface : {}
-
+    for_each = var.network_interface != null ? [local.primary_network_interface] : []
     content {
-      delete_on_termination = network_interface.value.delete_on_termination
-      device_index          = coalesce(network_interface.value.device_index, network_interface.key)
-      network_card_index    = network_interface.value.network_card_index
-      network_interface_id  = network_interface.value.network_interface_id
-
+      device_index         = 0
+      network_interface_id = network_interface.value.network_interface_id
     }
   }
 
@@ -357,14 +357,10 @@ resource "aws_instance" "ignore_ami" {
   monitoring = var.monitoring
 
   dynamic "network_interface" {
-    for_each = var.network_interface != null ? var.network_interface : {}
-
+    for_each = var.network_interface != null ? [local.primary_network_interface] : []
     content {
-      delete_on_termination = network_interface.value.delete_on_termination
-      device_index          = coalesce(network_interface.value.device_index, network_interface.key)
-      network_card_index    = network_interface.value.network_card_index
-      network_interface_id  = network_interface.value.network_interface_id
-
+      device_index         = 0
+      network_interface_id = network_interface.value.network_interface_id
     }
   }
 
@@ -544,14 +540,10 @@ resource "aws_spot_instance_request" "this" {
   monitoring = var.monitoring
 
   dynamic "network_interface" {
-    for_each = var.network_interface != null ? var.network_interface : {}
-
+    for_each = var.network_interface != null ? [local.primary_network_interface] : []
     content {
-      delete_on_termination = network_interface.value.delete_on_termination
-      device_index          = try(network_interface.value.device_index, network_interface.key)
-      network_card_index    = network_interface.value.network_card_index
-      network_interface_id  = network_interface.value.network_interface_id
-
+      device_index         = 0
+      network_interface_id = network_interface.value.network_interface_id
     }
   }
 
@@ -807,6 +799,18 @@ resource "aws_vpc_security_group_ingress_rule" "this" {
   to_port = try(coalesce(each.value.to_port, each.value.from_port), null)
 }
 
+################################################################################
+# Network Interface Attachment
+################################################################################
+
+resource "aws_network_interface_attachment" "this" {
+  for_each = var.create && var.create_network_interface_attachment ? local.secondary_network_interfaces : {}
+
+  instance_id          = local.instance_id
+  network_interface_id = each.value.network_interface_id
+  device_index         = each.value.device_index
+}
+
 ################################################################################
 # Elastic IP
 ################################################################################
diff --git a/variables.tf b/variables.tf
index 8df6532c..323eb4e8 100644
--- a/variables.tf
+++ b/variables.tf
@@ -605,3 +605,9 @@ variable "putin_khuylo" {
   type        = bool
   default     = true
 }
+
+variable "create_network_interface_attachment" {
+  description = "Whether to create network interface attachments"
+  type        = bool
+  default     = false
+}