runbooks 0.7.9__py3-none-any.whl → 0.9.0__py3-none-any.whl

runbooks/inventory/organizations_discovery.py

@@ -8,7 +8,7 @@ Scope: Enhanced multi-account discovery for 200+ accounts with Organizations API
 
 ENHANCED: 4-Profile AWS SSO Architecture & Performance Benchmarking (v0.8.0)
 - Proven FinOps success patterns: 61 accounts, $474,406 validated
-- Performance targets: <45s for multi-account discovery operations  
+- Performance targets: <45s for multi-account discovery operations
 - Comprehensive error handling with profile fallbacks
 - Enterprise-grade reliability and monitoring
 """
@@ -26,7 +26,7 @@ import boto3
 from botocore.exceptions import ClientError, NoCredentialsError
 from rich.console import Console
 from rich.panel import Panel
-from rich.progress import Progress, SpinnerColumn, TextColumn, BarColumn, TimeElapsedColumn
+from rich.progress import BarColumn, Progress, SpinnerColumn, TextColumn, TimeElapsedColumn
 from rich.status import Status
 from rich.table import Table
 
@@ -39,16 +39,17 @@ logger = configure_logger(__name__)
 
 # Enterprise 4-Profile AWS SSO Architecture (Proven FinOps Success Pattern)
 ENTERPRISE_PROFILES = {
-    "BILLING_PROFILE": "ams-admin-Billing-ReadOnlyAccess-909135376185",        # Cost Explorer access
-    "MANAGEMENT_PROFILE": "ams-admin-ReadOnlyAccess-909135376185",              # Organizations access  
-    "CENTRALISED_OPS_PROFILE": "ams-centralised-ops-ReadOnlyAccess-335083429030", # Operations access
-    "SINGLE_ACCOUNT_PROFILE": "ams-shared-services-non-prod-ReadOnlyAccess-499201730520"  # Single account ops
+    "BILLING_PROFILE": "ams-admin-Billing-ReadOnlyAccess-909135376185",  # Cost Explorer access
+    "MANAGEMENT_PROFILE": "ams-admin-ReadOnlyAccess-909135376185",  # Organizations access
+    "CENTRALISED_OPS_PROFILE": "ams-centralised-ops-ReadOnlyAccess-335083429030",  # Operations access
+    "SINGLE_ACCOUNT_PROFILE": "ams-shared-services-non-prod-ReadOnlyAccess-499201730520",  # Single account ops
 }
 
-@dataclass 
+
+@dataclass
 class PerformanceBenchmark:
     """Performance benchmarking for enterprise scale operations"""
-    
+
     operation_name: str
     start_time: datetime
     end_time: Optional[datetime] = None
@@ -58,18 +59,18 @@ class PerformanceBenchmark:
     error_message: Optional[str] = None
     accounts_processed: int = 0
     api_calls_made: int = 0
-    
+
     def finish(self, success: bool = True, error_message: Optional[str] = None):
         """Mark benchmark as complete"""
         self.end_time = datetime.now(timezone.utc)
         self.duration_seconds = (self.end_time - self.start_time).total_seconds()
         self.success = success
         self.error_message = error_message
-        
+
     def is_within_target(self) -> bool:
         """Check if operation completed within target time"""
         return self.duration_seconds <= self.target_seconds
-        
+
     def get_performance_grade(self) -> str:
         """Get performance grade based on target achievement"""
         if not self.success:
@@ -77,13 +78,13 @@ class PerformanceBenchmark:
         elif self.duration_seconds <= self.target_seconds * 0.5:
             return "A+"  # Exceptional performance (under 50% of target)
         elif self.duration_seconds <= self.target_seconds * 0.75:
-            return "A"   # Excellent performance (under 75% of target)
+            return "A"  # Excellent performance (under 75% of target)
         elif self.duration_seconds <= self.target_seconds:
-            return "B"   # Good performance (within target)
+            return "B"  # Good performance (within target)
         elif self.duration_seconds <= self.target_seconds * 1.5:
-            return "C"   # Acceptable performance (within 150% of target)
+            return "C"  # Acceptable performance (within 150% of target)
         else:
-            return "D"   # Poor performance (over 150% of target)
+            return "D"  # Poor performance (over 150% of target)
 
 
 @dataclass
@@ -143,7 +144,7 @@ class CrossAccountRole:
 class EnhancedOrganizationsDiscovery:
     """
     Enhanced multi-account discovery with 4-Profile AWS SSO Architecture
-    
+
     Implements proven FinOps success patterns with enterprise-grade reliability:
     - 4-profile AWS SSO architecture with failover
     - Performance benchmarking targeting <45s operations
@@ -166,7 +167,7 @@ class EnhancedOrganizationsDiscovery:
 
         Args:
             management_profile: AWS profile with Organizations read access
-            billing_profile: AWS profile with Cost Explorer access  
+            billing_profile: AWS profile with Cost Explorer access
             operational_profile: AWS profile with operational access
             single_account_profile: AWS profile for single account operations
             max_workers: Maximum concurrent workers for parallel operations
@@ -177,14 +178,14 @@ class EnhancedOrganizationsDiscovery:
         self.billing_profile = billing_profile or ENTERPRISE_PROFILES["BILLING_PROFILE"]
         self.operational_profile = operational_profile or ENTERPRISE_PROFILES["CENTRALISED_OPS_PROFILE"]
         self.single_account_profile = single_account_profile or ENTERPRISE_PROFILES["SINGLE_ACCOUNT_PROFILE"]
-        
+
         self.max_workers = max_workers
         self.performance_target_seconds = performance_target_seconds
 
         # Initialize session storage for all 4 profiles
         self.sessions = {}
         self.clients = {}
-        
+
         # Cache for discovered data
         self.accounts_cache: Dict[str, AWSAccount] = {}
         self.ous_cache: Dict[str, OrganizationalUnit] = {}
@@ -212,7 +213,7 @@ class EnhancedOrganizationsDiscovery:
     def initialize_sessions(self) -> Dict[str, str]:
         """
         Initialize AWS sessions with 4-profile architecture and comprehensive validation
-        
+
         Implements enterprise-grade session management with:
         - Profile validation and credential verification
         - Comprehensive error handling and fallback
@@ -221,11 +222,11 @@ class EnhancedOrganizationsDiscovery:
         """
         profiles_to_test = [
             ("management", self.management_profile),
-            ("billing", self.billing_profile), 
+            ("billing", self.billing_profile),
             ("operational", self.operational_profile),
             ("single_account", self.single_account_profile),
         ]
-        
+
         session_results = {
             "status": "initializing",
             "profiles_tested": 0,
@@ -243,25 +244,24 @@ class EnhancedOrganizationsDiscovery:
             TimeElapsedColumn(),
             console=console,
         ) as progress:
-            
             task = progress.add_task("Initializing AWS profiles...", total=len(profiles_to_test))
-            
+
             for profile_type, profile_name in profiles_to_test:
                 progress.update(task, description=f"Testing profile: {profile_type}")
                 session_results["profiles_tested"] += 1
                 self.discovery_metrics["profiles_tested"] += 1
-                
+
                 try:
                     # Create session and verify credentials
                     session = boto3.Session(profile_name=profile_name)
                     sts_client = session.client("sts")
                     identity = sts_client.get_caller_identity()
-                    
+
                     # Store successful session
                     self.sessions[profile_type] = session
                     session_results["profiles_successful"] += 1
                     self.discovery_metrics["profiles_successful"] += 1
-                    
+
                     # Store session details
                     session_results["session_details"][profile_type] = {
                         "profile_name": profile_name,
@@ -270,7 +270,7 @@ class EnhancedOrganizationsDiscovery:
                         "user_id": identity["UserId"],
                         "status": "active",
                     }
-                    
+
                     # Initialize specific clients based on profile type
                     if profile_type == "management":
                         self.clients["organizations"] = session.client("organizations")
@@ -283,54 +283,62 @@ class EnhancedOrganizationsDiscovery:
                         self.clients["sts_operational"] = sts_client
                     elif profile_type == "single_account":
                         self.clients["sts_single"] = sts_client
-                    
+
                     console.print(f"✅ [green]{profile_type}[/green]: {identity['Account']} ({profile_name})")
-                    
+
                 except (NoCredentialsError, ClientError) as e:
                     error_msg = f"Profile '{profile_type}' ({profile_name}) failed: {str(e)}"
                     session_results["errors"].append(error_msg)
                     self.discovery_metrics["errors_encountered"] += 1
                     console.print(f"❌ [red]{profile_type}[/red]: {str(e)}")
-                    
+
                     # Add warning about missing profile
-                    session_results["warnings"].append(f"Profile {profile_type} unavailable - some features may be limited")
-                
+                    session_results["warnings"].append(
+                        f"Profile {profile_type} unavailable - some features may be limited"
+                    )
+
                 progress.advance(task)
-        
+
         # Determine overall status
         if session_results["profiles_successful"] == 0:
             session_results["status"] = "failed"
             session_results["message"] = "No AWS profiles could be initialized - check credentials"
         elif session_results["profiles_successful"] < len(profiles_to_test):
             session_results["status"] = "partial"
-            session_results["message"] = f"Initialized {session_results['profiles_successful']}/{len(profiles_to_test)} profiles"
+            session_results["message"] = (
+                f"Initialized {session_results['profiles_successful']}/{len(profiles_to_test)} profiles"
+            )
         else:
             session_results["status"] = "success"
-            session_results["message"] = f"All {session_results['profiles_successful']} profiles initialized successfully"
-        
+            session_results["message"] = (
+                f"All {session_results['profiles_successful']} profiles initialized successfully"
+            )
+
         # Display summary panel
         summary_text = f"""
-[green]✅ Successful:[/green] {session_results['profiles_successful']}/{len(profiles_to_test)} profiles
-[yellow]⚠️  Warnings:[/yellow] {len(session_results['warnings'])} profile issues  
-[red]❌ Errors:[/red] {len(session_results['errors'])} initialization failures
+[green]✅ Successful:[/green] {session_results["profiles_successful"]}/{len(profiles_to_test)} profiles
+[yellow]⚠️  Warnings:[/yellow] {len(session_results["warnings"])} profile issues  
+[red]❌ Errors:[/red] {len(session_results["errors"])} initialization failures
         """
-        
-        console.print(Panel(
-            summary_text.strip(),
-            title=f"[bold cyan]4-Profile AWS SSO Initialization[/bold cyan]",
-            title_align="left",
-            border_style="cyan"
-        ))
-        
+
+        console.print(
+            Panel(
+                summary_text.strip(),
+                title=f"[bold cyan]4-Profile AWS SSO Initialization[/bold cyan]",
+                title_align="left",
+                border_style="cyan",
+            )
+        )
+
         return session_results
 
     async def discover_organization_structure(self) -> Dict:
         """
         Discover complete organization structure with performance benchmarking
-        
+
         Enhanced with:
         - Performance benchmark tracking (<45s target)
-        - Rich console progress monitoring  
+        - Rich console progress monitoring
         - Comprehensive error recovery
         - Multi-profile fallback support
         """
@@ -338,23 +346,33 @@ class EnhancedOrganizationsDiscovery:
         self.current_benchmark = PerformanceBenchmark(
             operation_name="organization_structure_discovery",
             start_time=datetime.now(timezone.utc),
-            target_seconds=self.performance_target_seconds
+            target_seconds=self.performance_target_seconds,
         )
-        
+
         logger.info("🏢 Starting enhanced organization structure discovery with performance tracking")
         self.discovery_metrics["start_time"] = self.current_benchmark.start_time
-        
+
         with Status("Initializing enterprise discovery...", console=console, spinner="dots"):
             try:
                 # Initialize sessions with 4-profile architecture
                 session_result = self.initialize_sessions()
                 if session_result["status"] == "failed":
                     self.current_benchmark.finish(success=False, error_message="Profile initialization failed")
+                    # CRITICAL FIX: Ensure performance_grade and metrics are set during early failures
+                    self.discovery_metrics["performance_grade"] = self.current_benchmark.get_performance_grade()
+                    self.discovery_metrics["end_time"] = self.current_benchmark.end_time
+                    self.discovery_metrics["duration_seconds"] = self.current_benchmark.duration_seconds
+                    self.discovery_metrics["errors_encountered"] += 1
+                    # Create performance benchmark dict with computed performance_grade for early failures
+                    performance_benchmark_dict = asdict(self.current_benchmark)
+                    performance_benchmark_dict["performance_grade"] = self.current_benchmark.get_performance_grade()
+
                     return {
-                        "status": "error", 
+                        "status": "error",
                         "error": "Profile initialization failed",
                         "session_result": session_result,
-                        "benchmark": asdict(self.current_benchmark)
+                        "metrics": self.discovery_metrics,
+                        "performance_benchmark": performance_benchmark_dict,
                     }
 
                 # Continue with partial profile set if needed
@@ -370,16 +388,15 @@ class EnhancedOrganizationsDiscovery:
                     TimeElapsedColumn(),
                     console=console,
                 ) as progress:
-                    
                     discovery_task = progress.add_task("Discovering organization structure...", total=5)
-                    
+
                     # Discover accounts
                     progress.update(discovery_task, description="Discovering accounts...")
                     accounts_result = await self._discover_accounts()
                     self.current_benchmark.accounts_processed = accounts_result.get("total_accounts", 0)
                     progress.advance(discovery_task)
 
-                    # Discover organizational units  
+                    # Discover organizational units
                     progress.update(discovery_task, description="Discovering organizational units...")
                     ous_result = await self._discover_organizational_units()
                     progress.advance(discovery_task)
@@ -403,7 +420,7 @@ class EnhancedOrganizationsDiscovery:
                 self.current_benchmark.finish(success=True)
                 self.current_benchmark.api_calls_made = self.discovery_metrics["api_calls_made"]
                 self.benchmarks.append(self.current_benchmark)
-                
+
                 # Calculate final metrics
                 self.discovery_metrics["end_time"] = self.current_benchmark.end_time
                 self.discovery_metrics["duration_seconds"] = self.current_benchmark.duration_seconds
@@ -416,18 +433,24 @@ class EnhancedOrganizationsDiscovery:
 
 ⏱️  Duration: [bold {performance_color}]{self.current_benchmark.duration_seconds:.1f}s[/bold {performance_color}] (Target: {self.performance_target_seconds}s)
 📈 Grade: [bold {performance_color}]{self.current_benchmark.get_performance_grade()}[/bold {performance_color}]
-🏢 Accounts: [yellow]{self.discovery_metrics['accounts_discovered']}[/yellow] 
-🏗️  OUs: [yellow]{self.discovery_metrics['ous_discovered']}[/yellow]
-🔐 Roles: [yellow]{self.discovery_metrics['roles_discovered']}[/yellow]
-📡 API Calls: [blue]{self.discovery_metrics['api_calls_made']}[/blue]
+🏢 Accounts: [yellow]{self.discovery_metrics["accounts_discovered"]}[/yellow] 
+🏗️  OUs: [yellow]{self.discovery_metrics["ous_discovered"]}[/yellow]
+🔐 Roles: [yellow]{self.discovery_metrics["roles_discovered"]}[/yellow]
+📡 API Calls: [blue]{self.discovery_metrics["api_calls_made"]}[/blue]
 """
-                
-                console.print(Panel(
-                    performance_text.strip(),
-                    title="[bold green]✅ Discovery Complete[/bold green]",
-                    title_align="left",
-                    border_style="green" if self.current_benchmark.is_within_target() else "red"
-                ))
+
+                console.print(
+                    Panel(
+                        performance_text.strip(),
+                        title="[bold green]✅ Discovery Complete[/bold green]",
+                        title_align="left",
+                        border_style="green" if self.current_benchmark.is_within_target() else "red",
+                    )
+                )
+
+                # Create performance benchmark dict with computed performance_grade
+                performance_benchmark_dict = asdict(self.current_benchmark)
+                performance_benchmark_dict["performance_grade"] = self.current_benchmark.get_performance_grade()
 
                 return {
                     "status": "completed",
@@ -438,7 +461,7 @@ class EnhancedOrganizationsDiscovery:
                     "cross_account_roles": roles_result,
                     "session_info": session_result,
                     "metrics": self.discovery_metrics,
-                    "performance_benchmark": asdict(self.current_benchmark),
+                    "performance_benchmark": performance_benchmark_dict,
                     "timestamp": datetime.now().isoformat(),
                 }
 
@@ -446,27 +469,45 @@ class EnhancedOrganizationsDiscovery:
                 # Handle discovery failure
                 error_message = f"Organization discovery failed: {str(e)}"
                 logger.error(error_message)
-                
+
                 if self.current_benchmark:
                     self.current_benchmark.finish(success=False, error_message=error_message)
                     self.benchmarks.append(self.current_benchmark)
-                
+                    # CRITICAL FIX: Ensure performance_grade is always set, even during errors
+                    self.discovery_metrics["performance_grade"] = self.current_benchmark.get_performance_grade()
+                else:
+                    # No benchmark available - set failed performance grade
+                    self.discovery_metrics["performance_grade"] = "F"
+
                 self.discovery_metrics["errors_encountered"] += 1
-                
+                # Ensure end_time and duration are set for error cases
+                self.discovery_metrics["end_time"] = datetime.now(timezone.utc)
+                if self.discovery_metrics["start_time"]:
+                    duration = (
+                        self.discovery_metrics["end_time"] - self.discovery_metrics["start_time"]
+                    ).total_seconds()
+                    self.discovery_metrics["duration_seconds"] = duration
+
+                # Create performance benchmark dict with computed performance_grade for errors
+                performance_benchmark_dict = None
+                if self.current_benchmark:
+                    performance_benchmark_dict = asdict(self.current_benchmark)
+                    performance_benchmark_dict["performance_grade"] = self.current_benchmark.get_performance_grade()
+
                 return {
-                    "status": "error", 
-                    "error": error_message, 
+                    "status": "error",
+                    "error": error_message,
                     "metrics": self.discovery_metrics,
-                    "performance_benchmark": asdict(self.current_benchmark) if self.current_benchmark else None
+                    "performance_benchmark": performance_benchmark_dict,
                 }
 
     async def _discover_accounts(self) -> Dict:
         """
         Discover all accounts in the organization using 4-profile architecture
-        
+
         Enhanced with:
         - Multi-profile fallback support
-        - Comprehensive error handling  
+        - Comprehensive error handling
         - Performance optimizations
         - Rich progress tracking
         """
@@ -514,13 +555,13 @@ class EnhancedOrganizationsDiscovery:
             active_accounts = [a for a in accounts if a.status == "ACTIVE"]
             suspended_accounts = [a for a in accounts if a.status == "SUSPENDED"]
             closed_accounts = [a for a in accounts if a.status == "CLOSED"]
-            
+
             logger.info(f"✅ Discovered {len(accounts)} total accounts ({len(active_accounts)} active)")
 
             return {
                 "total_accounts": len(accounts),
                 "active_accounts": len(active_accounts),
-                "suspended_accounts": len(suspended_accounts), 
+                "suspended_accounts": len(suspended_accounts),
                 "closed_accounts": len(closed_accounts),
                 "accounts": [asdict(account) for account in accounts],
                 "discovery_method": "organizations_api",
@@ -530,7 +571,7 @@ class EnhancedOrganizationsDiscovery:
         except ClientError as e:
             logger.error(f"Failed to discover accounts via Organizations API: {e}")
             self.discovery_metrics["errors_encountered"] += 1
-            
+
             # Attempt fallback discovery
             logger.info("Attempting fallback account discovery...")
             return await self._discover_accounts_fallback()
@@ -538,19 +579,19 @@ class EnhancedOrganizationsDiscovery:
     async def _discover_accounts_fallback(self) -> Dict:
         """
         Fallback account discovery when Organizations API is not available
-        
+
         Uses individual profile sessions to identify accessible accounts
         """
         logger.info("🔄 Using fallback account discovery via individual profiles")
-        
+
         discovered_accounts = {}
-        
+
         for profile_type, session in self.sessions.items():
             try:
                 sts_client = session.client("sts")
                 identity = sts_client.get_caller_identity()
                 account_id = identity["Account"]
-                
+
                 if account_id not in discovered_accounts:
                     # Create account info from STS identity
                     account = AWSAccount(
@@ -560,28 +601,28 @@ class EnhancedOrganizationsDiscovery:
                         status="ACTIVE",  # Assume active if accessible
                         joined_method="UNKNOWN",
                         joined_timestamp=None,
-                        tags={"DiscoveryMethod": "fallback", "ProfileType": profile_type}
+                        tags={"DiscoveryMethod": "fallback", "ProfileType": profile_type},
                     )
-                    
+
                     discovered_accounts[account_id] = account
                     self.accounts_cache[account_id] = account
-                
+
                 self.discovery_metrics["api_calls_made"] += 1
-                
+
             except Exception as e:
                 logger.debug(f"Could not get identity for profile {profile_type}: {e}")
                 continue
-        
+
         accounts = list(discovered_accounts.values())
         self.discovery_metrics["accounts_discovered"] = len(accounts)
-        
+
         logger.info(f"✅ Fallback discovery found {len(accounts)} accessible accounts")
-        
+
         return {
             "total_accounts": len(accounts),
             "active_accounts": len(accounts),  # All fallback accounts assumed active
             "suspended_accounts": 0,
-            "closed_accounts": 0, 
+            "closed_accounts": 0,
             "accounts": [asdict(account) for account in accounts],
             "discovery_method": "fallback_sts",
             "profile_used": "multiple",
@@ -590,7 +631,7 @@ class EnhancedOrganizationsDiscovery:
     async def _discover_organizational_units(self) -> Dict:
         """
         Discover all organizational units with enhanced error handling
-        
+
         Enhanced with:
         - Multi-profile fallback support
         - Comprehensive error recovery
@@ -606,12 +647,12 @@ class EnhancedOrganizationsDiscovery:
                 "total_ous": 0,
                 "organizational_units": [],
                 "discovery_method": "unavailable",
-                "message": "Organizations API not accessible - OU discovery skipped"
+                "message": "Organizations API not accessible - OU discovery skipped",
             }
 
         try:
             organizations_client = self.clients["organizations"]
-            
+
             # Get root OU
             roots_response = organizations_client.list_roots()
             if not roots_response.get("Roots"):
@@ -621,9 +662,9 @@ class EnhancedOrganizationsDiscovery:
                     "total_ous": 0,
                     "organizational_units": [],
                     "discovery_method": "organizations_api",
-                    "message": "No root OUs found in organization"
+                    "message": "No root OUs found in organization",
                 }
-                
+
             root_id = roots_response["Roots"][0]["Id"]
             self.discovery_metrics["api_calls_made"] += 1
 
@@ -634,7 +675,7 @@ class EnhancedOrganizationsDiscovery:
             except ClientError as ou_error:
                 logger.warning(f"Partial OU discovery failed: {ou_error}")
                 # Continue with what we have discovered so far
-                
+
             self.discovery_metrics["ous_discovered"] = len(all_ous)
 
             logger.info(f"✅ Discovered {len(all_ous)} organizational units")
@@ -650,7 +691,7 @@ class EnhancedOrganizationsDiscovery:
         except ClientError as e:
             logger.error(f"Failed to discover OUs: {e}")
             self.discovery_metrics["errors_encountered"] += 1
-            
+
             # Return graceful failure result instead of raising
             return {
                 "root_id": None,
@@ -658,14 +699,14 @@ class EnhancedOrganizationsDiscovery:
                 "organizational_units": [],
                 "discovery_method": "failed",
                 "error": str(e),
-                "message": "OU discovery failed - continuing without organizational structure"
+                "message": "OU discovery failed - continuing without organizational structure",
             }
 
     async def _discover_ou_recursive(self, parent_id: str, ou_list: List[OrganizationalUnit]):
         """Recursively discover organizational units with enhanced error handling"""
         try:
             organizations_client = self.clients["organizations"]
-            
+
             # Get child OUs
             paginator = organizations_client.get_paginator("list_organizational_units_for_parent")
 
@@ -702,7 +743,7 @@ class EnhancedOrganizationsDiscovery:
 
         try:
             organizations_client = self.clients["organizations"]
-            
+
             for account_id, account in self.accounts_cache.items():
                 # Find which OU this account belongs to
                 try:
@@ -821,14 +862,14 @@ class EnhancedOrganizationsDiscovery:
             logger.warning("Organizations client not available - using fallback organization info")
             return {
                 "organization_id": "unavailable",
-                "master_account_id": "unavailable", 
+                "master_account_id": "unavailable",
                 "master_account_email": "unavailable",
                 "feature_set": "unavailable",
                 "available_policy_types": [],
                 "discovery_method": "unavailable",
-                "message": "Organizations API not accessible"
+                "message": "Organizations API not accessible",
             }
-        
+
         try:
             organizations_client = self.clients["organizations"]
             org_response = organizations_client.describe_organization()
@@ -849,18 +890,18 @@ class EnhancedOrganizationsDiscovery:
             return {
                 "organization_id": "error",
                 "master_account_id": "error",
-                "master_account_email": "error", 
+                "master_account_email": "error",
                 "feature_set": "error",
                 "available_policy_types": [],
                 "discovery_method": "failed",
                 "error": str(e),
-                "message": "Organization info retrieval failed"
+                "message": "Organization info retrieval failed",
             }
 
     async def get_cost_validation_data(self, time_range_days: int = 30) -> Dict:
         """
         Get cost data for validation and analysis using 4-profile architecture
-        
+
         Enhanced with:
         - Billing profile validation and fallback
         - Comprehensive error handling
@@ -880,7 +921,7 @@ class EnhancedOrganizationsDiscovery:
                 "cost_by_account": {},
                 "high_spend_accounts": {},
                 "discovery_method": "unavailable",
-                "message": "Billing profile not accessible - cost data unavailable"
+                "message": "Billing profile not accessible - cost data unavailable",
             }
 
         try:
@@ -918,11 +959,15 @@ class EnhancedOrganizationsDiscovery:
 
             # Enhanced cost analysis
             high_spend_accounts = {
-                k: round(v, 2) for k, v in cost_by_account.items() if v > 1000  # >$1000/month
+                k: round(v, 2)
+                for k, v in cost_by_account.items()
+                if v > 1000  # >$1000/month
             }
-            
+
             medium_spend_accounts = {
-                k: round(v, 2) for k, v in cost_by_account.items() if 100 <= v <= 1000  # $100-$1000/month
+                k: round(v, 2)
+                for k, v in cost_by_account.items()
+                if 100 <= v <= 1000  # $100-$1000/month
             }
 
             logger.info(f"✅ Cost validation complete: ${total_cost:.2f} across {len(cost_by_account)} accounts")
@@ -939,16 +984,16 @@ class EnhancedOrganizationsDiscovery:
                 "profile_used": "billing",
                 "cost_breakdown": {
                     "high_spend_count": len(high_spend_accounts),
-                    "medium_spend_count": len(medium_spend_accounts), 
+                    "medium_spend_count": len(medium_spend_accounts),
                     "low_spend_count": len(cost_by_account) - len(high_spend_accounts) - len(medium_spend_accounts),
                     "average_cost_per_account": round(total_cost / len(cost_by_account), 2) if cost_by_account else 0,
-                }
+                },
             }
 
         except ClientError as e:
             logger.error(f"Failed to get cost data: {e}")
             self.discovery_metrics["errors_encountered"] += 1
-            
+
             return {
                 "status": "error",
                 "time_range_days": time_range_days,
@@ -1089,16 +1134,16 @@ async def run_enhanced_organizations_discovery(
 ) -> Dict:
     """
     Run complete enhanced organizations discovery workflow with 4-profile architecture
-    
+
     Implements proven FinOps success patterns with enterprise-grade reliability:
     - 4-profile AWS SSO architecture with failover
-    - Performance benchmarking targeting <45s operations  
+    - Performance benchmarking targeting <45s operations
     - Comprehensive error handling and profile fallbacks
     - Rich console progress tracking and monitoring
-    
+
     Args:
         management_profile: AWS profile with Organizations access (defaults to proven enterprise profile)
-        billing_profile: AWS profile with Cost Explorer access (defaults to proven enterprise profile) 
+        billing_profile: AWS profile with Cost Explorer access (defaults to proven enterprise profile)
         operational_profile: AWS profile with operational access (defaults to proven enterprise profile)
         single_account_profile: AWS profile for single account operations (defaults to proven enterprise profile)
         performance_target_seconds: Performance target for discovery operations (default: 45s)
@@ -1107,17 +1152,19 @@ async def run_enhanced_organizations_discovery(
         Complete discovery results with organization structure, costs, analysis, and performance metrics
     """
 
-    console.print(Panel.fit(
-        "[bold bright_cyan]🚀 Enhanced Organizations Discovery[/bold bright_cyan]\n\n"
-        "[green]✨ Features:[/green]\n"
-        "• 4-Profile AWS SSO Architecture\n"
-        "• Performance Benchmarking (<45s target)\n"
-        "• Comprehensive Error Handling\n" 
-        "• Multi-Account Enterprise Scale\n\n"
-        "[yellow]⚡ Initializing enhanced discovery engine...[/yellow]",
-        title="Enterprise Discovery Engine v0.8.0",
-        style="bright_cyan"
-    ))
+    console.print(
+        Panel.fit(
+            "[bold bright_cyan]🚀 Enhanced Organizations Discovery[/bold bright_cyan]\n\n"
+            "[green]✨ Features:[/green]\n"
+            "• 4-Profile AWS SSO Architecture\n"
+            "• Performance Benchmarking (<45s target)\n"
+            "• Comprehensive Error Handling\n"
+            "• Multi-Account Enterprise Scale\n\n"
+            "[yellow]⚡ Initializing enhanced discovery engine...[/yellow]",
+            title="Enterprise Discovery Engine v0.8.0",
+            style="bright_cyan",
+        )
+    )
 
     discovery = EnhancedOrganizationsDiscovery(
         management_profile=management_profile,
@@ -1125,14 +1172,14 @@ async def run_enhanced_organizations_discovery(
         operational_profile=operational_profile,
         single_account_profile=single_account_profile,
         max_workers=50,
-        performance_target_seconds=performance_target_seconds
+        performance_target_seconds=performance_target_seconds,
     )
 
     # Run main discovery with performance benchmarking
     org_results = await discovery.discover_organization_structure()
 
     if org_results["status"] == "completed":
-        # Add cost validation using billing profile  
+        # Add cost validation using billing profile
         cost_data = await discovery.get_cost_validation_data()
         org_results["cost_validation"] = cost_data
 
@@ -1143,19 +1190,20 @@ async def run_enhanced_organizations_discovery(
         # Add hierarchy visualization
         hierarchy_viz = discovery.generate_account_hierarchy_visualization()
         org_results["hierarchy_visualization"] = hierarchy_viz
-        
+
         # Add performance summary
         org_results["performance_summary"] = {
             "benchmarks_completed": len(discovery.benchmarks),
             "total_duration": org_results["performance_benchmark"]["duration_seconds"],
-            "performance_grade": org_results["performance_benchmark"]["performance_grade"],
+            "performance_grade": org_results["performance_benchmark"].get("performance_grade", "N/A"),
             "target_achieved": discovery.current_benchmark.is_within_target() if discovery.current_benchmark else False,
             "profiles_successful": org_results["session_info"]["profiles_successful"],
-            "api_calls_total": org_results["metrics"]["api_calls_made"]
+            "api_calls_total": org_results["metrics"]["api_calls_made"],
         }
 
     return org_results
 
+
 # Legacy compatibility function
 async def run_organizations_discovery(
     management_profile: str = "ams-admin-ReadOnlyAccess-909135376185",
@@ -1163,12 +1211,12 @@ async def run_organizations_discovery(
 ) -> Dict:
     """
     Legacy compatibility function - redirects to enhanced discovery
-    
+
     Returns:
         Complete discovery results using enhanced 4-profile architecture
     """
     console.print("[yellow]ℹ️  Using enhanced discovery engine for improved reliability and performance[/yellow]")
-    
+
     return await run_enhanced_organizations_discovery(
         management_profile=management_profile,
         billing_profile=billing_profile,
@@ -1191,7 +1239,7 @@ if __name__ == "__main__":
         help=f"AWS profile with Cost Explorer access (default: {ENTERPRISE_PROFILES['BILLING_PROFILE']})",
     )
     parser.add_argument(
-        "--operational-profile", 
+        "--operational-profile",
         help=f"AWS profile with operational access (default: {ENTERPRISE_PROFILES['CENTRALISED_OPS_PROFILE']})",
     )
     parser.add_argument(
@@ -1205,11 +1253,7 @@ if __name__ == "__main__":
         help="Performance target in seconds (default: 45s)",
     )
     parser.add_argument("--output", "-o", default="enhanced_organizations_discovery.json", help="Output file path")
-    parser.add_argument(
-        "--legacy", 
-        action="store_true",
-        help="Use legacy discovery method (compatibility mode)"
-    )
+    parser.add_argument("--legacy", action="store_true", help="Use legacy discovery method (compatibility mode)")
 
     args = parser.parse_args()
 
@@ -1218,7 +1262,7 @@ if __name__ == "__main__":
             console.print("[yellow]⚠️  Using legacy compatibility mode[/yellow]")
             results = await run_organizations_discovery(
                 management_profile=args.management_profile or ENTERPRISE_PROFILES["MANAGEMENT_PROFILE"],
-                billing_profile=args.billing_profile or ENTERPRISE_PROFILES["BILLING_PROFILE"]
+                billing_profile=args.billing_profile or ENTERPRISE_PROFILES["BILLING_PROFILE"],
             )
         else:
             console.print("[cyan]🚀 Using enhanced 4-profile discovery engine[/cyan]")
@@ -1235,35 +1279,37 @@ if __name__ == "__main__":
             json.dump(results, f, indent=2, default=str)
 
         # Create enhanced Rich formatted summary
-        accounts_count = results.get('accounts', {}).get('total_accounts', 0)
-        ous_count = results.get('organizational_units', {}).get('total_ous', 0)
-        monthly_cost = results.get('cost_validation', {}).get('total_monthly_cost', 0)
-        
+        accounts_count = results.get("accounts", {}).get("total_accounts", 0)
+        ous_count = results.get("organizational_units", {}).get("total_ous", 0)
+        monthly_cost = results.get("cost_validation", {}).get("total_monthly_cost", 0)
+
         # Performance metrics if available
-        performance_grade = results.get('performance_benchmark', {}).get('performance_grade', 'N/A')
-        duration = results.get('performance_benchmark', {}).get('duration_seconds', 0)
-        profiles_successful = results.get('session_info', {}).get('profiles_successful', 0)
-        
+        performance_grade = results.get("performance_benchmark", {}).get("performance_grade", "N/A")
+        duration = results.get("performance_benchmark", {}).get("duration_seconds", 0)
+        profiles_successful = results.get("session_info", {}).get("profiles_successful", 0)
+
         summary_table = Table(show_header=False, box=None)
         summary_table.add_column("Metric", style="cyan", no_wrap=True)
         summary_table.add_column("Value", style="green")
-        
+
         summary_table.add_row("📊 Accounts discovered:", f"{accounts_count}")
         summary_table.add_row("🏢 OUs discovered:", f"{ous_count}")
         summary_table.add_row("💰 Monthly cost:", f"${monthly_cost:,.2f}" if monthly_cost else "N/A")
-        
+
         if not args.legacy:
             summary_table.add_row("⚡ Performance grade:", f"{performance_grade}")
             summary_table.add_row("⏱️  Duration:", f"{duration:.1f}s")
             summary_table.add_row("🔧 Profiles active:", f"{profiles_successful}/4")
-        
+
         title_color = "green" if performance_grade in ["A+", "A", "B"] else "yellow"
-        
-        console.print(Panel(
-            summary_table,
-            title=f"[{title_color}]✅ Enhanced Discovery Complete - Results saved to {args.output}[/{title_color}]",
-            title_align="left",
-            border_style=title_color
-        ))
+
+        console.print(
+            Panel(
+                summary_table,
+                title=f"[{title_color}]✅ Enhanced Discovery Complete - Results saved to {args.output}[/{title_color}]",
+                title_align="left",
+                border_style=title_color,
+            )
+        )
 
     asyncio.run(main())