From 12b409e0def8601b27f9cad733ba37b40f5edfa6 Mon Sep 17 00:00:00 2001
From: Josh McCullen <46718985+MVJosh@users.noreply.github.com>
Date: Fri, 7 May 2021 13:50:26 +0100
Subject: [PATCH] Set multiple Security Groups when calling
 modify_network_interface_attribute (#3911)

---
 moto/ec2/models.py                                |  6 +++---
 moto/ec2/responses/elastic_network_interfaces.py  |  5 ++---
 tests/test_ec2/test_elastic_network_interfaces.py | 11 +++++++----
 3 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/moto/ec2/models.py b/moto/ec2/models.py
index 90e2fbfac..026316ea3 100644
--- a/moto/ec2/models.py
+++ b/moto/ec2/models.py
@@ -479,10 +479,10 @@ class NetworkInterfaceBackend(object):
 
         found_eni.instance.detach_eni(found_eni)
 
-    def modify_network_interface_attribute(self, eni_id, group_id):
+    def modify_network_interface_attribute(self, eni_id, group_ids):
         eni = self.get_network_interface(eni_id)
-        group = self.get_security_group_from_id(group_id)
-        eni._group_set = [group]
+        groups = [self.get_security_group_from_id(group_id) for group_id in group_ids]
+        eni._group_set = groups
 
     def get_all_network_interfaces(self, eni_ids=None, filters=None):
         enis = self.enis.values()
diff --git a/moto/ec2/responses/elastic_network_interfaces.py b/moto/ec2/responses/elastic_network_interfaces.py
index 6761b294e..101c0ac16 100644
--- a/moto/ec2/responses/elastic_network_interfaces.py
+++ b/moto/ec2/responses/elastic_network_interfaces.py
@@ -56,11 +56,10 @@ class ElasticNetworkInterfaces(BaseResponse):
             return template.render()
 
     def modify_network_interface_attribute(self):
-        # Currently supports modifying one and only one security group
         eni_id = self._get_param("NetworkInterfaceId")
-        group_id = self._get_param("SecurityGroupId.1")
+        group_ids = self._get_multi_param("SecurityGroupId")
         if self.is_not_dryrun("ModifyNetworkInterface"):
-            self.ec2_backend.modify_network_interface_attribute(eni_id, group_id)
+            self.ec2_backend.modify_network_interface_attribute(eni_id, group_ids)
             return MODIFY_NETWORK_INTERFACE_ATTRIBUTE_RESPONSE
 
     def reset_network_interface_attribute(self):
diff --git a/tests/test_ec2/test_elastic_network_interfaces.py b/tests/test_ec2/test_elastic_network_interfaces.py
index db6dcc04f..0c3d5795e 100644
--- a/tests/test_ec2/test_elastic_network_interfaces.py
+++ b/tests/test_ec2/test_elastic_network_interfaces.py
@@ -133,7 +133,7 @@ def test_elastic_network_interfaces_modify_attribute():
 
     with pytest.raises(EC2ResponseError) as ex:
         conn.modify_network_interface_attribute(
-            eni.id, "groupset", [security_group2.id], dry_run=True
+            eni.id, "groupset", [security_group1.id, security_group2.id], dry_run=True
         )
     ex.value.error_code.should.equal("DryRunOperation")
     ex.value.status.should.equal(400)
@@ -141,14 +141,17 @@ def test_elastic_network_interfaces_modify_attribute():
         "An error occurred (DryRunOperation) when calling the ModifyNetworkInterface operation: Request would have succeeded, but DryRun flag is set"
     )
 
-    conn.modify_network_interface_attribute(eni.id, "groupset", [security_group2.id])
+    conn.modify_network_interface_attribute(
+        eni.id, "groupset", [security_group1.id, security_group2.id]
+    )
 
     all_enis = conn.get_all_network_interfaces()
     all_enis.should.have.length_of(1)
 
     eni = all_enis[0]
-    eni.groups.should.have.length_of(1)
-    eni.groups[0].id.should.equal(security_group2.id)
+    eni.groups.should.have.length_of(2)
+    eni.groups[0].id.should.equal(security_group1.id)
+    eni.groups[1].id.should.equal(security_group2.id)
 
 
 @mock_ec2_deprecated