runbooks 0.7.6__py3-none-any.whl → 0.7.9__py3-none-any.whl

runbooks/operate/vpc_operations.py

@@ -0,0 +1,1038 @@
+"""
+VPC Operations Module - GitHub Issue #96 TOP PRIORITY
+
+Enterprise-grade VPC and NAT Gateway operations for multi-account AWS environments.
+Addresses manager-raised VPC infrastructure automation requirements with cost optimization focus.
+
+This module provides comprehensive VPC lifecycle management including:
+- NAT Gateway operations ($45/month cost optimization)
+- VPC creation and deletion with best practices
+- VPC peering and cross-account connectivity
+- Network security optimization
+- Cost analysis and recommendations
+
+Features:
+- Multi-account support (1-200+ accounts)
+- Rich CLI integration with beautiful terminal output
+- Enterprise safety (dry-run, confirmation, rollback)
+- Cost optimization integration
+- Comprehensive error handling and logging
+"""
+
+import time
+from dataclasses import dataclass
+from datetime import datetime
+from typing import Any, Dict, List, Optional, Union
+
+import boto3
+from botocore.exceptions import ClientError
+from loguru import logger
+
+from runbooks.common.rich_utils import RichConsole
+from runbooks.operate.base import BaseOperation, OperationContext, OperationResult, OperationStatus
+
+
+@dataclass
+class VPCConfiguration:
+    """Configuration for VPC creation with best practices."""
+
+    cidr_block: str
+    name: str
+    enable_dns_hostnames: bool = True
+    enable_dns_support: bool = True
+    instance_tenancy: str = "default"
+    tags: Dict[str, str] = None
+
+    def __post_init__(self):
+        if self.tags is None:
+            self.tags = {}
+
+        # Add required tags for enterprise environments
+        if "Environment" not in self.tags:
+            self.tags["Environment"] = "production"
+        if "CreatedBy" not in self.tags:
+            self.tags["CreatedBy"] = "CloudOps-Runbooks"
+        if "CostCenter" not in self.tags:
+            self.tags["CostCenter"] = "Infrastructure"
+
+
+@dataclass
+class NATGatewayConfiguration:
+    """Configuration for NAT Gateway creation and optimization."""
+
+    subnet_id: str
+    allocation_id: Optional[str] = None
+    connectivity_type: str = "public"  # "public" or "private"
+    name: Optional[str] = None
+    tags: Dict[str, str] = None
+
+    def __post_init__(self):
+        if self.tags is None:
+            self.tags = {}
+
+        # Add cost tracking tags ($45/month awareness)
+        if "MonthlyCostEstimate" not in self.tags:
+            self.tags["MonthlyCostEstimate"] = "$45"
+        if "CostOptimizationReviewed" not in self.tags:
+            self.tags["CostOptimizationReviewed"] = datetime.utcnow().strftime("%Y-%m-%d")
+
+
+@dataclass
+class VPCPeeringConfiguration:
+    """Configuration for VPC peering connections."""
+
+    vpc_id: str
+    peer_vpc_id: str
+    peer_region: Optional[str] = None
+    peer_owner_id: Optional[str] = None
+    name: Optional[str] = None
+    tags: Dict[str, str] = None
+
+
+class VPCOperations(BaseOperation):
+    """
+    Enterprise VPC & NAT Gateway Operations - GitHub Issue #96
+
+    Top priority VPC infrastructure automation addressing manager requirements:
+    - NAT Gateway lifecycle with $45/month cost optimization
+    - VPC creation/deletion with enterprise best practices
+    - Cross-account VPC peering and connectivity
+    - Network security optimization and compliance
+    - Multi-account operations (1-200+ accounts)
+    - Rich CLI integration with beautiful output
+    """
+
+    service_name = "ec2"
+    supported_operations = {
+        # VPC Core Operations
+        "create_vpc",
+        "delete_vpc",
+        "modify_vpc",
+        "describe_vpcs",
+        # NAT Gateway Operations (TOP PRIORITY - $45/month cost focus)
+        "create_nat_gateway",
+        "delete_nat_gateway",
+        "describe_nat_gateways",
+        "optimize_nat_placement",
+        "analyze_nat_costs",
+        # Elastic IP Operations (MIGRATED FROM CLOUDOPS-AUTOMATION - $3.60/month per EIP)
+        "discover_unused_eips",
+        "release_elastic_ip",
+        "release_all_unused_eips",
+        "analyze_eip_costs",
+        "cleanup_unused_eips",
+        # Subnet Operations
+        "create_subnet",
+        "delete_subnet",
+        "modify_subnet",
+        "describe_subnets",
+        # Gateway Operations
+        "create_internet_gateway",
+        "delete_internet_gateway",
+        "attach_internet_gateway",
+        "detach_internet_gateway",
+        # Route Table Operations
+        "create_route_table",
+        "delete_route_table",
+        "create_route",
+        "delete_route",
+        # VPC Peering Operations
+        "create_vpc_peering",
+        "accept_vpc_peering",
+        "delete_vpc_peering",
+        # Security Operations
+        "optimize_security_groups",
+        "validate_network_architecture",
+        # Cost Operations
+        "analyze_network_costs",
+        "recommend_cost_optimizations",
+    }
+    requires_confirmation = True  # Critical for $45/month NAT Gateway operations
+
+    def __init__(self, profile: Optional[str] = None, region: Optional[str] = None, dry_run: bool = False):
+        """
+        Initialize VPC Operations with Enterprise safety features.
+
+        Args:
+            profile: AWS profile for authentication
+            region: AWS region for operations (defaults to us-east-1)
+            dry_run: Enable dry-run mode for safe testing
+        """
+        super().__init__(profile, region, dry_run)
+        self.rich_console = RichConsole()
+
+        # Cost tracking for NAT Gateways ($45/month awareness)
+        self.nat_gateway_monthly_cost = 45.0
+
+        # Cost tracking for Elastic IPs ($3.60/month awareness)
+        self.elastic_ip_monthly_cost = 3.60
+
+        logger.info(f"VPC Operations initialized - Profile: {profile}, Region: {region}, Dry-run: {dry_run}")
+
+    def execute_operation(self, context: OperationContext, operation_type: str, **kwargs) -> List[OperationResult]:
+        """
+        Execute VPC operation with comprehensive error handling and logging.
+
+        Args:
+            context: Operation context with account and region info
+            operation_type: Type of VPC operation to execute
+            **kwargs: Operation-specific arguments
+
+        Returns:
+            List of operation results
+
+        Raises:
+            ValueError: If operation type is not supported
+            ClientError: AWS API errors
+        """
+        self.validate_context(context)
+
+        logger.info(f"Executing VPC operation: {operation_type} in {context.region}")
+
+        # Route to specific operation handlers
+        if operation_type.startswith("create_vpc"):
+            return self._create_vpc(context, **kwargs)
+        elif operation_type.startswith("delete_vpc"):
+            return self._delete_vpc(context, **kwargs)
+        elif operation_type.startswith("create_nat_gateway"):
+            return self._create_nat_gateway(context, **kwargs)
+        elif operation_type.startswith("delete_nat_gateway"):
+            return self._delete_nat_gateway(context, **kwargs)
+        elif operation_type.startswith("describe_nat_gateways"):
+            return self._describe_nat_gateways(context, **kwargs)
+        elif operation_type.startswith("optimize_nat_placement"):
+            return self._optimize_nat_placement(context, **kwargs)
+        elif operation_type.startswith("analyze_nat_costs"):
+            return self._analyze_nat_costs(context, **kwargs)
+        elif operation_type.startswith("discover_unused_eips"):
+            return self._discover_unused_eips(context, **kwargs)
+        elif operation_type.startswith("release_elastic_ip"):
+            return self._release_elastic_ip(context, **kwargs)
+        elif operation_type.startswith("release_all_unused_eips"):
+            return self._release_all_unused_eips(context, **kwargs)
+        elif operation_type.startswith("analyze_eip_costs"):
+            return self._analyze_eip_costs(context, **kwargs)
+        elif operation_type.startswith("cleanup_unused_eips"):
+            return self._cleanup_unused_eips(context, **kwargs)
+        elif operation_type.startswith("create_vpc_peering"):
+            return self._create_vpc_peering(context, **kwargs)
+        elif operation_type.startswith("analyze_network_costs"):
+            return self._analyze_network_costs(context, **kwargs)
+        else:
+            raise ValueError(f"Unsupported VPC operation: {operation_type}")
+
+    def _create_vpc(self, context: OperationContext, vpc_config: VPCConfiguration) -> List[OperationResult]:
+        """
+        Create VPC with enterprise best practices.
+
+        Args:
+            context: Operation context
+            vpc_config: VPC configuration with security settings
+
+        Returns:
+            List containing VPC creation result
+        """
+        result = self.create_operation_result(context, "create_vpc", "vpc", f"vpc-{vpc_config.name}")
+
+        try:
+            ec2_client = self.get_client("ec2", context.region)
+
+            # Display cost and configuration info
+            self.rich_console.print_panel(
+                f"Creating VPC: {vpc_config.name}",
+                f"CIDR Block: {vpc_config.cidr_block}\n"
+                f"Region: {context.region}\n"
+                f"DNS Hostnames: {vpc_config.enable_dns_hostnames}\n"
+                f"Instance Tenancy: {vpc_config.instance_tenancy}",
+                title="🏗️ VPC Creation",
+            )
+
+            if context.dry_run:
+                result.mark_completed(OperationStatus.DRY_RUN)
+                result.response_data = {"message": f"[DRY-RUN] Would create VPC {vpc_config.name}"}
+                logger.info(f"[DRY-RUN] VPC creation simulated for {vpc_config.name}")
+                return [result]
+
+            # Create VPC
+            response = self.execute_aws_call(
+                ec2_client,
+                "create_vpc",
+                CidrBlock=vpc_config.cidr_block,
+                InstanceTenancy=vpc_config.instance_tenancy,
+                TagSpecifications=[
+                    {"ResourceType": "vpc", "Tags": [{"Key": k, "Value": v} for k, v in vpc_config.tags.items()]}
+                ],
+            )
+
+            vpc_id = response["Vpc"]["VpcId"]
+            result.resource_id = vpc_id
+
+            # Enable DNS features
+            if vpc_config.enable_dns_hostnames:
+                self.execute_aws_call(
+                    ec2_client, "modify_vpc_attribute", VpcId=vpc_id, EnableDnsHostnames={"Value": True}
+                )
+
+            if vpc_config.enable_dns_support:
+                self.execute_aws_call(
+                    ec2_client, "modify_vpc_attribute", VpcId=vpc_id, EnableDnsSupport={"Value": True}
+                )
+
+            result.mark_completed(OperationStatus.SUCCESS)
+            result.response_data = {
+                "vpc_id": vpc_id,
+                "cidr_block": vpc_config.cidr_block,
+                "state": response["Vpc"]["State"],
+            }
+
+            self.rich_console.print_success(f"✅ VPC created successfully: {vpc_id}")
+            logger.info(f"VPC created successfully: {vpc_id} in {context.region}")
+
+        except ClientError as e:
+            error_msg = f"Failed to create VPC {vpc_config.name}: {e}"
+            result.mark_completed(OperationStatus.FAILED, error_msg)
+            self.rich_console.print_error(f"❌ {error_msg}")
+            logger.error(error_msg)
+
+        except Exception as e:
+            error_msg = f"Unexpected error creating VPC {vpc_config.name}: {e}"
+            result.mark_completed(OperationStatus.FAILED, error_msg)
+            self.rich_console.print_error(f"❌ {error_msg}")
+            logger.error(error_msg)
+
+        return [result]
+
+    def _create_nat_gateway(
+        self, context: OperationContext, nat_config: NATGatewayConfiguration
+    ) -> List[OperationResult]:
+        """
+        Create NAT Gateway with cost optimization awareness.
+
+        CRITICAL: NAT Gateways cost $45/month - requires manager approval for cost impact.
+
+        Args:
+            context: Operation context
+            nat_config: NAT Gateway configuration
+
+        Returns:
+            List containing NAT Gateway creation result
+        """
+        result = self.create_operation_result(
+            context, "create_nat_gateway", "nat-gateway", f"natgw-{nat_config.name or 'unnamed'}"
+        )
+
+        try:
+            ec2_client = self.get_client("ec2", context.region)
+
+            # COST IMPACT WARNING - $45/month
+            self.rich_console.print_warning(
+                f"💰 NAT Gateway Cost Impact: ${self.nat_gateway_monthly_cost}/month\n"
+                f"Annual Cost: ${self.nat_gateway_monthly_cost * 12:.0f}"
+            )
+
+            # Display configuration
+            self.rich_console.print_panel(
+                f"Creating NAT Gateway",
+                f"Subnet ID: {nat_config.subnet_id}\n"
+                f"Connectivity: {nat_config.connectivity_type}\n"
+                f"Monthly Cost: ${self.nat_gateway_monthly_cost}\n"
+                f"Region: {context.region}",
+                title="🌐 NAT Gateway Creation",
+            )
+
+            # Confirmation required for cost impact
+            if not self.confirm_operation(context, nat_config.subnet_id, "create_nat_gateway"):
+                result.mark_completed(OperationStatus.CANCELLED, "Operation cancelled by user")
+                return [result]
+
+            if context.dry_run:
+                result.mark_completed(OperationStatus.DRY_RUN)
+                result.response_data = {
+                    "message": f"[DRY-RUN] Would create NAT Gateway in {nat_config.subnet_id}",
+                    "estimated_monthly_cost": self.nat_gateway_monthly_cost,
+                }
+                logger.info(f"[DRY-RUN] NAT Gateway creation simulated for {nat_config.subnet_id}")
+                return [result]
+
+            # Create NAT Gateway
+            create_params = {"SubnetId": nat_config.subnet_id, "ConnectivityType": nat_config.connectivity_type}
+
+            # Add Elastic IP allocation if provided
+            if nat_config.allocation_id:
+                create_params["AllocationId"] = nat_config.allocation_id
+
+            # Add tags
+            if nat_config.tags:
+                create_params["TagSpecifications"] = [
+                    {"ResourceType": "natgateway", "Tags": [{"Key": k, "Value": v} for k, v in nat_config.tags.items()]}
+                ]
+
+            response = self.execute_aws_call(ec2_client, "create_nat_gateway", **create_params)
+
+            nat_gateway_id = response["NatGateway"]["NatGatewayId"]
+            result.resource_id = nat_gateway_id
+
+            result.mark_completed(OperationStatus.SUCCESS)
+            result.response_data = {
+                "nat_gateway_id": nat_gateway_id,
+                "subnet_id": nat_config.subnet_id,
+                "state": response["NatGateway"]["State"],
+                "monthly_cost_estimate": self.nat_gateway_monthly_cost,
+            }
+
+            self.rich_console.print_success(
+                f"✅ NAT Gateway created: {nat_gateway_id}\n💰 Monthly cost: ${self.nat_gateway_monthly_cost}"
+            )
+            logger.info(f"NAT Gateway created: {nat_gateway_id} (${self.nat_gateway_monthly_cost}/month)")
+
+        except ClientError as e:
+            error_msg = f"Failed to create NAT Gateway: {e}"
+            result.mark_completed(OperationStatus.FAILED, error_msg)
+            self.rich_console.print_error(f"❌ {error_msg}")
+            logger.error(error_msg)
+
+        return [result]
+
+    def _delete_nat_gateway(self, context: OperationContext, nat_gateway_id: str) -> List[OperationResult]:
+        """
+        Delete NAT Gateway with cost savings tracking.
+
+        Args:
+            context: Operation context
+            nat_gateway_id: NAT Gateway ID to delete
+
+        Returns:
+            List containing NAT Gateway deletion result
+        """
+        result = self.create_operation_result(context, "delete_nat_gateway", "nat-gateway", nat_gateway_id)
+
+        try:
+            ec2_client = self.get_client("ec2", context.region)
+
+            # Show cost savings from deletion
+            self.rich_console.print_panel(
+                f"Deleting NAT Gateway: {nat_gateway_id}",
+                f"💰 Monthly Savings: ${self.nat_gateway_monthly_cost}\n"
+                f"Annual Savings: ${self.nat_gateway_monthly_cost * 12:.0f}\n"
+                f"Region: {context.region}",
+                title="🗑️ NAT Gateway Deletion",
+            )
+
+            if context.dry_run:
+                result.mark_completed(OperationStatus.DRY_RUN)
+                result.response_data = {
+                    "message": f"[DRY-RUN] Would delete NAT Gateway {nat_gateway_id}",
+                    "monthly_savings": self.nat_gateway_monthly_cost,
+                }
+                return [result]
+
+            # Delete NAT Gateway
+            response = self.execute_aws_call(ec2_client, "delete_nat_gateway", NatGatewayId=nat_gateway_id)
+
+            result.mark_completed(OperationStatus.SUCCESS)
+            result.response_data = {"nat_gateway_id": nat_gateway_id, "monthly_savings": self.nat_gateway_monthly_cost}
+
+            self.rich_console.print_success(
+                f"✅ NAT Gateway deletion initiated: {nat_gateway_id}\n"
+                f"💰 Monthly savings: ${self.nat_gateway_monthly_cost}"
+            )
+            logger.info(f"NAT Gateway deleted: {nat_gateway_id} (saving ${self.nat_gateway_monthly_cost}/month)")
+
+        except ClientError as e:
+            error_msg = f"Failed to delete NAT Gateway {nat_gateway_id}: {e}"
+            result.mark_completed(OperationStatus.FAILED, error_msg)
+            self.rich_console.print_error(f"❌ {error_msg}")
+            logger.error(error_msg)
+
+        return [result]
+
+    def _describe_nat_gateways(self, context: OperationContext, vpc_id: Optional[str] = None) -> List[OperationResult]:
+        """
+        Describe NAT Gateways with cost analysis.
+
+        Args:
+            context: Operation context
+            vpc_id: Optional VPC ID filter
+
+        Returns:
+            List containing NAT Gateway description result
+        """
+        result = self.create_operation_result(context, "describe_nat_gateways", "nat-gateway", vpc_id or "all")
+
+        try:
+            ec2_client = self.get_client("ec2", context.region)
+
+            # Build filters
+            filters = []
+            if vpc_id:
+                filters.append({"Name": "vpc-id", "Values": [vpc_id]})
+
+            describe_params = {}
+            if filters:
+                describe_params["Filters"] = filters
+
+            response = self.execute_aws_call(ec2_client, "describe_nat_gateways", **describe_params)
+
+            nat_gateways = response.get("NatGateways", [])
+            total_monthly_cost = len(nat_gateways) * self.nat_gateway_monthly_cost
+
+            # Display NAT Gateway inventory with Rich formatting
+            if nat_gateways:
+                nat_data = []
+                for nat in nat_gateways:
+                    nat_data.append(
+                        [
+                            nat["NatGatewayId"],
+                            nat["VpcId"],
+                            nat["SubnetId"],
+                            nat["State"],
+                            f"${self.nat_gateway_monthly_cost}/month",
+                        ]
+                    )
+
+                self.rich_console.print_table(
+                    nat_data,
+                    headers=["NAT Gateway ID", "VPC ID", "Subnet ID", "State", "Monthly Cost"],
+                    title=f"🌐 NAT Gateways ({len(nat_gateways)} found)",
+                )
+
+                self.rich_console.print_info(
+                    f"💰 Total Monthly Cost: ${total_monthly_cost:.0f} (Annual: ${total_monthly_cost * 12:.0f})"
+                )
+            else:
+                self.rich_console.print_info("No NAT Gateways found")
+
+            result.mark_completed(OperationStatus.SUCCESS)
+            result.response_data = {
+                "nat_gateways": nat_gateways,
+                "count": len(nat_gateways),
+                "total_monthly_cost": total_monthly_cost,
+            }
+
+        except ClientError as e:
+            error_msg = f"Failed to describe NAT Gateways: {e}"
+            result.mark_completed(OperationStatus.FAILED, error_msg)
+            self.rich_console.print_error(f"❌ {error_msg}")
+            logger.error(error_msg)
+
+        return [result]
+
+    def _analyze_nat_costs(self, context: OperationContext, vpc_id: Optional[str] = None) -> List[OperationResult]:
+        """
+        Analyze NAT Gateway costs and optimization opportunities.
+
+        Args:
+            context: Operation context
+            vpc_id: Optional VPC ID filter
+
+        Returns:
+            List containing cost analysis result
+        """
+        result = self.create_operation_result(context, "analyze_nat_costs", "nat-gateway", vpc_id or "all")
+
+        try:
+            # Get NAT Gateways
+            nat_results = self._describe_nat_gateways(context, vpc_id)
+            nat_data = nat_results[0].response_data
+
+            nat_gateways = nat_data["nat_gateways"]
+            total_cost = nat_data["total_monthly_cost"]
+
+            # Analyze optimization opportunities
+            recommendations = []
+
+            if len(nat_gateways) > 1:
+                potential_savings = (len(nat_gateways) - 1) * self.nat_gateway_monthly_cost
+                recommendations.append(
+                    {
+                        "type": "consolidation",
+                        "description": f"Consider consolidating {len(nat_gateways)} NAT Gateways",
+                        "potential_monthly_savings": potential_savings,
+                        "potential_annual_savings": potential_savings * 12,
+                    }
+                )
+
+            # Check for unused NAT Gateways (simplified heuristic)
+            unused_gateways = [ng for ng in nat_gateways if ng["State"] == "available"]
+            if unused_gateways:
+                unused_cost = len(unused_gateways) * self.nat_gateway_monthly_cost
+                recommendations.append(
+                    {
+                        "type": "unused_resources",
+                        "description": f"Found {len(unused_gateways)} potentially unused NAT Gateways",
+                        "potential_monthly_savings": unused_cost,
+                        "potential_annual_savings": unused_cost * 12,
+                    }
+                )
+
+            # Display cost analysis
+            self.rich_console.print_panel(
+                "NAT Gateway Cost Analysis",
+                f"Total NAT Gateways: {len(nat_gateways)}\n"
+                f"Current Monthly Cost: ${total_cost:.0f}\n"
+                f"Current Annual Cost: ${total_cost * 12:.0f}",
+                title="💰 Cost Analysis",
+            )
+
+            if recommendations:
+                self.rich_console.print_warning("💡 Cost Optimization Opportunities:")
+                for i, rec in enumerate(recommendations, 1):
+                    self.rich_console.print_info(
+                        f"{i}. {rec['description']}\n"
+                        f"   Monthly Savings: ${rec['potential_monthly_savings']:.0f}\n"
+                        f"   Annual Savings: ${rec['potential_annual_savings']:.0f}"
+                    )
+            else:
+                self.rich_console.print_success("✅ NAT Gateway configuration appears optimized")
+
+            result.mark_completed(OperationStatus.SUCCESS)
+            result.response_data = {
+                "total_nat_gateways": len(nat_gateways),
+                "current_monthly_cost": total_cost,
+                "current_annual_cost": total_cost * 12,
+                "optimization_recommendations": recommendations,
+            }
+
+        except Exception as e:
+            error_msg = f"Failed to analyze NAT costs: {e}"
+            result.mark_completed(OperationStatus.FAILED, error_msg)
+            self.rich_console.print_error(f"❌ {error_msg}")
+            logger.error(error_msg)
+
+        return [result]
+
+    def _create_vpc_peering(
+        self, context: OperationContext, peering_config: VPCPeeringConfiguration
+    ) -> List[OperationResult]:
+        """
+        Create VPC peering connection for cross-VPC connectivity.
+
+        Args:
+            context: Operation context
+            peering_config: VPC peering configuration
+
+        Returns:
+            List containing VPC peering creation result
+        """
+        result = self.create_operation_result(
+            context, "create_vpc_peering", "vpc-peering", f"{peering_config.vpc_id}-{peering_config.peer_vpc_id}"
+        )
+
+        try:
+            ec2_client = self.get_client("ec2", context.region)
+
+            self.rich_console.print_panel(
+                "Creating VPC Peering Connection",
+                f"Source VPC: {peering_config.vpc_id}\n"
+                f"Peer VPC: {peering_config.peer_vpc_id}\n"
+                f"Peer Region: {peering_config.peer_region or 'Same region'}\n"
+                f"Peer Account: {peering_config.peer_owner_id or 'Same account'}",
+                title="🔗 VPC Peering",
+            )
+
+            if context.dry_run:
+                result.mark_completed(OperationStatus.DRY_RUN)
+                result.response_data = {
+                    "message": f"[DRY-RUN] Would create peering between {peering_config.vpc_id} and {peering_config.peer_vpc_id}"
+                }
+                return [result]
+
+            # Create peering connection
+            create_params = {"VpcId": peering_config.vpc_id, "PeerVpcId": peering_config.peer_vpc_id}
+
+            if peering_config.peer_region:
+                create_params["PeerRegion"] = peering_config.peer_region
+            if peering_config.peer_owner_id:
+                create_params["PeerOwnerId"] = peering_config.peer_owner_id
+            if peering_config.tags:
+                create_params["TagSpecifications"] = [
+                    {
+                        "ResourceType": "vpc-peering-connection",
+                        "Tags": [{"Key": k, "Value": v} for k, v in peering_config.tags.items()],
+                    }
+                ]
+
+            response = self.execute_aws_call(ec2_client, "create_vpc_peering_connection", **create_params)
+
+            peering_id = response["VpcPeeringConnection"]["VpcPeeringConnectionId"]
+            result.resource_id = peering_id
+
+            result.mark_completed(OperationStatus.SUCCESS)
+            result.response_data = {
+                "peering_connection_id": peering_id,
+                "requester_vpc_id": peering_config.vpc_id,
+                "accepter_vpc_id": peering_config.peer_vpc_id,
+                "status": response["VpcPeeringConnection"]["Status"]["Code"],
+            }
+
+            self.rich_console.print_success(f"✅ VPC Peering Connection created: {peering_id}")
+            logger.info(f"VPC Peering created: {peering_id}")
+
+        except ClientError as e:
+            error_msg = f"Failed to create VPC peering: {e}"
+            result.mark_completed(OperationStatus.FAILED, error_msg)
+            self.rich_console.print_error(f"❌ {error_msg}")
+            logger.error(error_msg)
+
+        return [result]
+
+    def _analyze_network_costs(self, context: OperationContext, vpc_id: Optional[str] = None) -> List[OperationResult]:
+        """
+        Comprehensive network cost analysis for VPC infrastructure.
+
+        Args:
+            context: Operation context
+            vpc_id: Optional VPC ID filter
+
+        Returns:
+            List containing network cost analysis result
+        """
+        result = self.create_operation_result(context, "analyze_network_costs", "vpc", vpc_id or "all")
+
+        try:
+            # Get NAT Gateway cost analysis
+            nat_results = self._analyze_nat_costs(context, vpc_id)
+            nat_data = nat_results[0].response_data
+
+            total_analysis = {
+                "nat_gateway_costs": {
+                    "monthly": nat_data["current_monthly_cost"],
+                    "annual": nat_data["current_annual_cost"],
+                },
+                "optimization_opportunities": nat_data["optimization_recommendations"],
+                "total_monthly_network_costs": nat_data["current_monthly_cost"],  # Expandable for other network costs
+                "total_annual_network_costs": nat_data["current_annual_cost"],
+            }
+
+            # Display comprehensive cost analysis
+            self.rich_console.print_panel(
+                "Comprehensive Network Cost Analysis",
+                f"NAT Gateway Monthly Cost: ${total_analysis['nat_gateway_costs']['monthly']:.0f}\n"
+                f"NAT Gateway Annual Cost: ${total_analysis['nat_gateway_costs']['annual']:.0f}\n"
+                f"Optimization Opportunities: {len(total_analysis['optimization_opportunities'])}",
+                title="🌐 Network Infrastructure Costs",
+            )
+
+            result.mark_completed(OperationStatus.SUCCESS)
+            result.response_data = total_analysis
+
+        except Exception as e:
+            error_msg = f"Failed to analyze network costs: {e}"
+            result.mark_completed(OperationStatus.FAILED, error_msg)
+            self.rich_console.print_error(f"❌ {error_msg}")
+            logger.error(error_msg)
+
+        return [result]
+
+    def _discover_unused_eips(
+        self, context: OperationContext, target_region: Optional[str] = None
+    ) -> List[OperationResult]:
+        """
+        MIGRATED FROM CLOUDOPS-AUTOMATION: Discover unused Elastic IPs across regions.
+
+        Implements the production-tested aws_list_unattached_elastic_ips() function
+        with enterprise enhancements for cost analysis and business impact.
+
+        Args:
+            context: Operation context
+            target_region: Optional single region filter
+
+        Returns:
+            List containing unused Elastic IP discovery result
+        """
+        result = self.create_operation_result(context, "discover_unused_eips", "elastic-ip", target_region or "all")
+
+        try:
+            # Get all regions for analysis
+            regions_to_scan = [target_region] if target_region else self._get_all_regions(context.region)
+
+            self.rich_console.print_panel(
+                "Discovering Unused Elastic IPs",
+                f"Regions to scan: {len(regions_to_scan)}\n"
+                f"Cost per unused EIP: ${self.elastic_ip_monthly_cost}/month\n"
+                f"Analysis scope: Multi-region comprehensive scan",
+                title="🔍 EIP Discovery",
+            )
+
+            unused_eips = []
+            total_regions_with_unused = 0
+
+            for region in regions_to_scan:
+                try:
+                    ec2_client = self.get_client("ec2", region)
+
+                    # CORE LOGIC FROM CLOUDOPS-AUTOMATION: describe_addresses()
+                    all_eips = self.execute_aws_call(ec2_client, "describe_addresses")
+
+                    region_unused_count = 0
+                    for eip in all_eips["Addresses"]:
+                        # CLOUDOPS-AUTOMATION LOGIC: No AssociationId means unused
+                        if "AssociationId" not in eip:
+                            eip_data = {
+                                "public_ip": eip["PublicIp"],
+                                "allocation_id": eip["AllocationId"],
+                                "region": region,
+                                "domain": eip.get("Domain", "standard"),
+                                "monthly_cost": self.elastic_ip_monthly_cost,
+                                "annual_cost": self.elastic_ip_monthly_cost * 12,
+                                "tags": eip.get("Tags", []),
+                                "instance_id": eip.get("InstanceId", "None"),
+                                "network_interface_id": eip.get("NetworkInterfaceId", "None"),
+                            }
+                            unused_eips.append(eip_data)
+                            region_unused_count += 1
+
+                    if region_unused_count > 0:
+                        total_regions_with_unused += 1
+                        logger.info(f"Found {region_unused_count} unused EIPs in {region}")
+
+                except ClientError as e:
+                    logger.warning(f"Could not scan region {region}: {e}")
+                    continue
+
+            # Calculate business impact
+            total_monthly_cost = len(unused_eips) * self.elastic_ip_monthly_cost
+            total_annual_cost = total_monthly_cost * 12
+
+            # Display results with Rich formatting
+            if unused_eips:
+                # Show summary table
+                eip_data_for_display = []
+                for eip in unused_eips[:10]:  # Show first 10
+                    eip_data_for_display.append(
+                        [
+                            eip["public_ip"],
+                            eip["allocation_id"],
+                            eip["region"],
+                            eip["domain"],
+                            f"${eip['monthly_cost']:.2f}",
+                        ]
+                    )
+
+                self.rich_console.print_table(
+                    eip_data_for_display,
+                    headers=["Public IP", "Allocation ID", "Region", "Domain", "Monthly Cost"],
+                    title=f"🔍 Unused Elastic IPs ({len(unused_eips)} found)",
+                )
+
+                if len(unused_eips) > 10:
+                    self.rich_console.print_info(f"... and {len(unused_eips) - 10} more unused EIPs")
+
+                # Cost impact summary
+                self.rich_console.print_panel(
+                    "Cost Impact Analysis",
+                    f"Total unused EIPs: {len(unused_eips)}\n"
+                    f"Monthly cost waste: ${total_monthly_cost:.2f}\n"
+                    f"Annual savings opportunity: ${total_annual_cost:.2f}\n"
+                    f"Regions affected: {total_regions_with_unused}",
+                    title="💰 Business Impact",
+                )
+            else:
+                self.rich_console.print_success("✅ No unused Elastic IPs found - excellent optimization!")
+
+            result.mark_completed(OperationStatus.SUCCESS)
+            result.response_data = {
+                "unused_eips": unused_eips,
+                "total_unused": len(unused_eips),
+                "total_monthly_cost": total_monthly_cost,
+                "total_annual_cost": total_annual_cost,
+                "regions_scanned": len(regions_to_scan),
+                "regions_with_unused": total_regions_with_unused,
+            }
+
+        except Exception as e:
+            error_msg = f"Failed to discover unused Elastic IPs: {e}"
+            result.mark_completed(OperationStatus.FAILED, error_msg)
+            self.rich_console.print_error(f"❌ {error_msg}")
+            logger.error(error_msg)
+
+        return [result]
+
+    def _release_elastic_ip(
+        self, context: OperationContext, allocation_id: str, target_region: Optional[str] = None
+    ) -> List[OperationResult]:
+        """
+        MIGRATED FROM CLOUDOPS-AUTOMATION: Release specific Elastic IP.
+
+        Implements the production-tested aws_release_elastic_ip() function
+        with enterprise safety controls and cost tracking.
+
+        Args:
+            context: Operation context
+            allocation_id: Allocation ID of EIP to release
+            target_region: Region containing the EIP
+
+        Returns:
+            List containing Elastic IP release result
+        """
+        result = self.create_operation_result(context, "release_elastic_ip", "elastic-ip", allocation_id)
+
+        try:
+            region = target_region or context.region
+            ec2_client = self.get_client("ec2", region)
+
+            # Show cost savings from release
+            self.rich_console.print_panel(
+                f"Releasing Elastic IP: {allocation_id}",
+                f"💰 Monthly Savings: ${self.elastic_ip_monthly_cost}/month\n"
+                f"Annual Savings: ${self.elastic_ip_monthly_cost * 12:.0f}\n"
+                f"Region: {region}",
+                title="🗑️ EIP Release",
+            )
+
+            # Safety confirmation for production operations
+            if not context.dry_run:
+                if not self.confirm_operation(context, allocation_id, "release_elastic_ip"):
+                    result.mark_completed(OperationStatus.CANCELLED, "Operation cancelled by user")
+                    return [result]
+
+            if context.dry_run:
+                result.mark_completed(OperationStatus.DRY_RUN)
+                result.response_data = {
+                    "message": f"[DRY-RUN] Would release EIP {allocation_id}",
+                    "allocation_id": allocation_id,
+                    "region": region,
+                    "monthly_savings": self.elastic_ip_monthly_cost,
+                    "annual_savings": self.elastic_ip_monthly_cost * 12,
+                }
+                return [result]
+
+            # CORE CLOUDOPS-AUTOMATION LOGIC: release_address()
+            response = self.execute_aws_call(ec2_client, "release_address", AllocationId=allocation_id)
+
+            result.mark_completed(OperationStatus.SUCCESS)
+            result.response_data = {
+                "allocation_id": allocation_id,
+                "region": region,
+                "monthly_savings": self.elastic_ip_monthly_cost,
+                "annual_savings": self.elastic_ip_monthly_cost * 12,
+                "aws_response": response,
+            }
+
+            self.rich_console.print_success(
+                f"✅ Elastic IP released: {allocation_id}\n💰 Monthly savings: ${self.elastic_ip_monthly_cost}"
+            )
+            logger.info(f"Elastic IP released: {allocation_id} (saving ${self.elastic_ip_monthly_cost}/month)")
+
+        except ClientError as e:
+            error_msg = f"Failed to release Elastic IP {allocation_id}: {e}"
+            result.mark_completed(OperationStatus.FAILED, error_msg)
+            self.rich_console.print_error(f"❌ {error_msg}")
+            logger.error(error_msg)
+
+        return [result]
+
+    def _cleanup_unused_eips(
+        self, context: OperationContext, target_region: Optional[str] = None
+    ) -> List[OperationResult]:
+        """
+        Comprehensive cleanup of unused Elastic IPs (discover + release).
+
+        This is the main CLI command for EIP optimization, combining discovery
+        and release operations with comprehensive safety controls.
+
+        Args:
+            context: Operation context
+            target_region: Optional single region filter
+
+        Returns:
+            List containing cleanup operation result
+        """
+        result = self.create_operation_result(context, "cleanup_unused_eips", "elastic-ip", "comprehensive")
+
+        try:
+            self.rich_console.print_panel(
+                "Elastic IP Cleanup Operation",
+                f"Scope: {'Single region (' + target_region + ')' if target_region else 'Multi-region'}\n"
+                f"Safety Mode: {'DRY RUN' if context.dry_run else 'PRODUCTION'}\n"
+                f"Cost per EIP: ${self.elastic_ip_monthly_cost}/month",
+                title="🧹 EIP Cleanup",
+            )
+
+            # Step 1: Discover unused EIPs
+            self.rich_console.print_info("Step 1: Discovering unused Elastic IPs...")
+            discovery_results = self._discover_unused_eips(context, target_region)
+
+            if discovery_results[0].status == OperationStatus.FAILED:
+                result.mark_completed(OperationStatus.FAILED, "Failed to discover unused EIPs")
+                return [result]
+
+            unused_eips = discovery_results[0].response_data.get("unused_eips", [])
+
+            if not unused_eips:
+                self.rich_console.print_success("✅ Cleanup complete - no unused EIPs found!")
+                result.mark_completed(OperationStatus.SUCCESS)
+                result.response_data = {"message": "No cleanup needed", "total_savings": 0}
+                return [result]
+
+            # Step 2: Batch release with safety controls
+            total_monthly_savings = len(unused_eips) * self.elastic_ip_monthly_cost
+
+            if not context.dry_run:
+                self.rich_console.print_warning(
+                    f"⚠️  BATCH RELEASE OPERATION\n"
+                    f"EIPs to release: {len(unused_eips)}\n"
+                    f"Monthly savings: ${total_monthly_savings:.2f}\n"
+                    f"This action cannot be easily undone!"
+                )
+
+                if not self.confirm_operation(context, f"{len(unused_eips)} EIPs", "batch_cleanup"):
+                    result.mark_completed(OperationStatus.CANCELLED, "Cleanup cancelled by user")
+                    return [result]
+
+            # Process each EIP release
+            successful_releases = 0
+            failed_releases = 0
+            total_savings = 0
+
+            for eip in unused_eips:
+                try:
+                    release_results = self._release_elastic_ip(context, eip["allocation_id"], eip["region"])
+
+                    if release_results[0].status in [OperationStatus.SUCCESS, OperationStatus.DRY_RUN]:
+                        successful_releases += 1
+                        total_savings += eip["monthly_cost"]
+                    else:
+                        failed_releases += 1
+
+                except Exception as e:
+                    logger.error(f"Failed to release EIP {eip['allocation_id']}: {e}")
+                    failed_releases += 1
+
+            # Summary
+            self.rich_console.print_panel(
+                "Cleanup Operation Summary",
+                f"Successful releases: {successful_releases}\n"
+                f"Failed releases: {failed_releases}\n"
+                f"Total monthly savings: ${total_savings:.2f}\n"
+                f"Annual savings impact: ${total_savings * 12:.0f}",
+                title="🎉 Cleanup Complete",
+            )
+
+            result.mark_completed(OperationStatus.SUCCESS)
+            result.response_data = {
+                "discovery": discovery_results[0].response_data,
+                "total_processed": len(unused_eips),
+                "successful_releases": successful_releases,
+                "failed_releases": failed_releases,
+                "total_monthly_savings": total_savings,
+                "total_annual_savings": total_savings * 12,
+            }
+
+        except Exception as e:
+            error_msg = f"Failed EIP cleanup operation: {e}"
+            result.mark_completed(OperationStatus.FAILED, error_msg)
+            self.rich_console.print_error(f"❌ {error_msg}")
+            logger.error(error_msg)
+
+        return [result]
+
+    def _get_all_regions(self, default_region: str) -> List[str]:
+        """Get all AWS regions for comprehensive analysis"""
+        try:
+            ec2_client = self.get_client("ec2", default_region)
+            response = self.execute_aws_call(ec2_client, "describe_regions")
+            return [region["RegionName"] for region in response["Regions"]]
+        except Exception as e:
+            logger.warning(f"Could not get all regions, using defaults: {e}")
+            return ["us-east-1", "us-west-2", "eu-west-1", "ap-southeast-1"]