Handling predictive network interfaces 'sometimes'?

[paul <paul@zot.org>]

Hi folks,

I'm reworking my old VPN server, and will use the Debian 10 AMI in AWS. 
I've noticed that predictable network interface names are enabled for t3 
servers, but not t2 - I have test setup on a t2.micro and a t3.micro, 
and only the t3 has predictable interface names. I'm trying to write up 
some Ansible templates for this new vpn setup.

I don't play around with iptables a lot (my netadmin-fu is weak), but 
what's the best way to go about writing a set of firewall rules that 
will satisfy both an eth0 and an ens5? Just simply duplicate the rule 
for each naming type? Disable predictable names somehow (google is 
confusing on how, exactly)? I'd like to end up with a template that 
'just works' without having to know about this t2/t3 difference issue. 
It's not the end of the world if I can't, but I'd like to avoid 
surprising 'future me' down the road.

Also, out of curiousity, how is the same AMI image detecting a 
difference between t2/t3 instance types and treating them differently 
for the purposes of network interface naming? What's the mechanism 
involved? I had previously thought that this was something baked into 
the image, rather than in response to hardware setup.

Thanks,

Paul Morahan