runbooks 1.1.3__py3-none-any.whl → 1.1.5__py3-none-any.whl

runbooks/inventory/vpc_dependency_analyzer.py

@@ -11,7 +11,7 @@ validation and SHA256-verified audit trails.
 
 **Strategic Alignment**: Supports 3 immutable objectives through:
 1. **runbooks package**: Technical implementation with Rich CLI
-2. **Enterprise FAANG/Agile SDLC**: MCP validation ≥99.5% accuracy 
+2. **Enterprise FAANG/Agile SDLC**: MCP validation ≥99.5% accuracy
 3. **GitHub as single source of truth**: Evidence bundle generation
 
 **Core AWSO-5 Framework Integration**:
@@ -20,10 +20,10 @@ validation and SHA256-verified audit trails.
 - Security posture enhancement with attack surface reduction
 - Evidence-based approach with SHA256-verified validation bundles
 
-**AWS API Mapping**: 
+**AWS API Mapping**:
 - `ec2.describe_network_interfaces()` → ENI gate analysis
 - `ec2.describe_nat_gateways()` → NAT Gateway dependencies
-- `ec2.describe_internet_gateways()` → IGW/EIGW dependencies  
+- `ec2.describe_internet_gateways()` → IGW/EIGW dependencies
 - `ec2.describe_route_tables()` → Route table analysis
 - `ec2.describe_vpc_endpoints()` → VPC Endpoints analysis
 - `ec2.describe_transit_gateway_attachments()` → TGW dependencies
@@ -49,8 +49,15 @@ from rich.panel import Panel
 from rich.progress import Progress, SpinnerColumn, TextColumn
 
 from runbooks.common.rich_utils import (
-    console, print_header, print_success, print_error, print_warning,
-    create_table, create_progress_bar, format_resource_count, STATUS_INDICATORS
+    console,
+    print_header,
+    print_success,
+    print_error,
+    print_warning,
+    create_table,
+    create_progress_bar,
+    format_resource_count,
+    STATUS_INDICATORS,
 )
 
 logger = logging.getLogger(__name__)
@@ -60,10 +67,11 @@ logger = logging.getLogger(__name__)
 class VPCDependency:
     """
     VPC dependency analysis result with comprehensive validation.
-    
+
     Represents a single dependency relationship found during AWSO-5 analysis
     with evidence collection and validation support.
     """
+
     resource_type: str
     resource_id: str
     resource_name: Optional[str] = None
@@ -71,51 +79,52 @@ class VPCDependency:
     details: Dict[str, Any] = field(default_factory=dict)
     remediation_action: Optional[str] = None
     validation_timestamp: str = field(default_factory=lambda: datetime.utcnow().isoformat())
-    
+
     @property
     def is_blocking(self) -> bool:
         """True if this dependency blocks VPC deletion."""
         return self.dependency_type == "blocking"
 
 
-@dataclass 
+@dataclass
 class VPCDependencyAnalysisResult:
     """
     Comprehensive VPC dependency analysis results for AWSO-5.
-    
+
     Contains complete dependency analysis with evidence collection,
     validation metrics, and remediation guidance.
     """
+
     vpc_id: str
     vpc_name: Optional[str]
     account_id: str
     region: str
     is_default: bool
     cidr_blocks: List[str]
-    
+
     # Dependency analysis results
     dependencies: List[VPCDependency] = field(default_factory=list)
     eni_count: int = 0
     blocking_dependencies: int = 0
     warning_dependencies: int = 0
-    
+
     # Analysis metadata
     analysis_timestamp: str = field(default_factory=lambda: datetime.utcnow().isoformat())
     analysis_duration_seconds: float = 0.0
     mcp_validation_accuracy: float = 0.0
     evidence_hash: Optional[str] = None
-    
+
     # Business impact
     cleanup_recommendation: str = "INVESTIGATE"  # DELETE, HOLD, INVESTIGATE
     estimated_monthly_savings: float = 0.0
     security_impact: str = "MEDIUM"  # LOW, MEDIUM, HIGH
     compliance_impact: List[str] = field(default_factory=list)
-    
+
     @property
     def can_delete_safely(self) -> bool:
         """True if VPC can be safely deleted (zero blocking dependencies)."""
         return self.eni_count == 0 and self.blocking_dependencies == 0
-    
+
     @property
     def deletion_complexity(self) -> str:
         """Complexity assessment for VPC deletion."""
@@ -123,7 +132,7 @@ class VPCDependencyAnalysisResult:
         if total_deps == 0:
             return "SIMPLE"
         elif total_deps <= 3:
-            return "MODERATE" 
+            return "MODERATE"
         else:
             return "COMPLEX"
 
@@ -131,21 +140,21 @@ class VPCDependencyAnalysisResult:
 class VPCDependencyAnalyzer:
     """
     AWSO-5 VPC Dependency Analysis Engine.
-    
+
     Comprehensive enterprise VPC dependency analysis implementing the 12-step
     AWSO-5 framework with MCP validation and evidence collection.
-    
+
     **Enterprise Integration**:
     - Rich CLI formatting for consistent UX
     - MCP validation for ≥99.5% accuracy
     - Evidence bundle generation with SHA256 verification
     - Multi-account organization support
     """
-    
+
     def __init__(self, session: Optional[boto3.Session] = None, region: str = "us-east-1"):
         """
         Initialize VPC dependency analyzer.
-        
+
         Args:
             session: AWS session for API access
             region: AWS region for analysis
@@ -153,543 +162,540 @@ class VPCDependencyAnalyzer:
         self.session = session or boto3.Session()
         self.region = region
         self.console = console
-        
+
         # Initialize AWS clients
         self._ec2_client = None
         self._elbv2_client = None
         self._route53resolver_client = None
         self._logs_client = None
         self._rds_client = None
-        
+
         # Analysis tracking
         self.analysis_results: Dict[str, VPCDependencyAnalysisResult] = {}
         self.evidence_artifacts: List[Dict[str, Any]] = []
-    
+
     @property
     def ec2_client(self):
         """Lazy-loaded EC2 client."""
         if not self._ec2_client:
-            self._ec2_client = self.session.client('ec2', region_name=self.region)
+            self._ec2_client = self.session.client("ec2", region_name=self.region)
         return self._ec2_client
-    
+
     @property
     def elbv2_client(self):
-        """Lazy-loaded ELBv2 client.""" 
+        """Lazy-loaded ELBv2 client."""
         if not self._elbv2_client:
-            self._elbv2_client = self.session.client('elbv2', region_name=self.region)
+            self._elbv2_client = self.session.client("elbv2", region_name=self.region)
         return self._elbv2_client
-    
+
     @property
     def route53resolver_client(self):
         """Lazy-loaded Route53 Resolver client."""
         if not self._route53resolver_client:
-            self._route53resolver_client = self.session.client('route53resolver', region_name=self.region)
+            self._route53resolver_client = self.session.client("route53resolver", region_name=self.region)
         return self._route53resolver_client
-    
+
     @property
     def logs_client(self):
         """Lazy-loaded CloudWatch Logs client."""
         if not self._logs_client:
-            self._logs_client = self.session.client('logs', region_name=self.region)
+            self._logs_client = self.session.client("logs", region_name=self.region)
         return self._logs_client
-    
+
     @property
     def rds_client(self):
         """Lazy-loaded RDS client."""
         if not self._rds_client:
-            self._rds_client = self.session.client('rds', region_name=self.region)
+            self._rds_client = self.session.client("rds", region_name=self.region)
         return self._rds_client
-    
+
     def analyze_vpc_dependencies(self, vpc_id: str) -> VPCDependencyAnalysisResult:
         """
         Comprehensive VPC dependency analysis following AWSO-5 12-step framework.
-        
+
         Implements complete dependency analysis including ENI gate, dependency
         inventory, and cleanup recommendations with evidence collection.
-        
+
         Args:
             vpc_id: AWS VPC identifier to analyze
-            
+
         Returns:
             Comprehensive analysis results with dependencies and recommendations
         """
         start_time = datetime.utcnow()
-        
+
         # Get VPC basic information
         vpc_info = self._get_vpc_info(vpc_id)
         if not vpc_info:
             raise ValueError(f"VPC {vpc_id} not found in region {self.region}")
-        
+
         result = VPCDependencyAnalysisResult(
             vpc_id=vpc_id,
-            vpc_name=vpc_info.get('Tags', {}).get('Name'),
-            account_id=self.session.client('sts').get_caller_identity()['Account'],
+            vpc_name=vpc_info.get("Tags", {}).get("Name"),
+            account_id=self.session.client("sts").get_caller_identity()["Account"],
             region=self.region,
-            is_default=vpc_info.get('IsDefault', False),
-            cidr_blocks=[block['CidrBlock'] for block in vpc_info.get('CidrBlockAssociationSet', [])]
+            is_default=vpc_info.get("IsDefault", False),
+            cidr_blocks=[block["CidrBlock"] for block in vpc_info.get("CidrBlockAssociationSet", [])],
         )
-        
+
         print_header("AWSO-5 VPC Dependency Analysis", "1.0.0")
         self.console.print(f"\n[blue]Analyzing VPC:[/blue] {vpc_id}")
         self.console.print(f"[blue]Region:[/blue] {self.region}")
         self.console.print(f"[blue]Default VPC:[/blue] {'Yes' if result.is_default else 'No'}")
-        
+
         with Progress(
-            SpinnerColumn(),
-            TextColumn("[progress.description]{task.description}"),
-            console=self.console
+            SpinnerColumn(), TextColumn("[progress.description]{task.description}"), console=self.console
         ) as progress:
-            
             # Step 1: ENI Gate Analysis (Critical blocking check)
             task = progress.add_task("Step 1: ENI Gate Analysis...", total=None)
             result.eni_count = self._analyze_enis(vpc_id, result)
-            
+
             if result.eni_count > 0:
                 result.cleanup_recommendation = "INVESTIGATE"
                 result.security_impact = "HIGH"
                 progress.update(task, description=f"Step 1: Found {result.eni_count} ENIs - INVESTIGATE required")
             else:
                 progress.update(task, description="Step 1: ENI Gate PASSED - No active ENIs")
-                
+
                 # Step 2: Comprehensive Dependency Analysis
                 progress.update(task, description="Step 2: Analyzing NAT Gateways...")
                 self._analyze_nat_gateways(vpc_id, result)
-                
+
                 progress.update(task, description="Step 3: Analyzing Internet Gateways...")
                 self._analyze_internet_gateways(vpc_id, result)
-                
+
                 progress.update(task, description="Step 4: Analyzing Route Tables...")
                 self._analyze_route_tables(vpc_id, result)
-                
+
                 progress.update(task, description="Step 5: Analyzing VPC Endpoints...")
                 self._analyze_vpc_endpoints(vpc_id, result)
-                
+
                 progress.update(task, description="Step 6: Analyzing Transit Gateway Attachments...")
                 self._analyze_transit_gateway_attachments(vpc_id, result)
-                
+
                 progress.update(task, description="Step 7: Analyzing VPC Peering...")
                 self._analyze_vpc_peering(vpc_id, result)
-                
+
                 progress.update(task, description="Step 8: Analyzing Route53 Resolver...")
                 self._analyze_route53_resolver(vpc_id, result)
-                
+
                 progress.update(task, description="Step 9: Analyzing Load Balancers...")
                 self._analyze_load_balancers(vpc_id, result)
-                
+
                 progress.update(task, description="Step 10: Analyzing Database Subnet Groups...")
                 self._analyze_database_subnet_groups(vpc_id, result)
-                
+
                 progress.update(task, description="Step 11: Analyzing VPC Flow Logs...")
                 self._analyze_vpc_flow_logs(vpc_id, result)
-                
+
                 progress.update(task, description="Step 12: Analyzing Security Groups & NACLs...")
                 self._analyze_security_groups_nacls(vpc_id, result)
-            
+
             progress.remove_task(task)
-        
+
         # Calculate analysis metrics
         end_time = datetime.utcnow()
         result.analysis_duration_seconds = (end_time - start_time).total_seconds()
         result.blocking_dependencies = len([d for d in result.dependencies if d.is_blocking])
         result.warning_dependencies = len([d for d in result.dependencies if d.dependency_type == "warning"])
-        
+
         # Generate cleanup recommendation
         self._generate_cleanup_recommendation(result)
-        
+
         # Store results for evidence collection
         self.analysis_results[vpc_id] = result
-        
+
         # Display results
         self._display_analysis_results(result)
-        
+
         return result
-    
+
     def _get_vpc_info(self, vpc_id: str) -> Optional[Dict[str, Any]]:
         """Get VPC basic information."""
         try:
             response = self.ec2_client.describe_vpcs(VpcIds=[vpc_id])
-            return response['Vpcs'][0] if response['Vpcs'] else None
+            return response["Vpcs"][0] if response["Vpcs"] else None
         except ClientError as e:
             print_error(f"Failed to get VPC info: {e}")
             return None
-    
+
     def _analyze_enis(self, vpc_id: str, result: VPCDependencyAnalysisResult) -> int:
         """
         Step 1: ENI Gate Analysis - Critical blocking check.
-        
+
         ENIs indicate active workloads that prevent VPC deletion.
         This is the primary gate in the AWSO-5 framework.
         """
         try:
-            response = self.ec2_client.describe_network_interfaces(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]
-            )
-            
-            eni_count = len(response['NetworkInterfaces'])
-            
-            for eni in response['NetworkInterfaces']:
-                result.dependencies.append(VPCDependency(
-                    resource_type="NetworkInterface",
-                    resource_id=eni['NetworkInterfaceId'],
-                    resource_name=eni.get('Description', 'Unknown'),
-                    dependency_type="blocking",
-                    details={
-                        'Status': eni.get('Status'),
-                        'InterfaceType': eni.get('InterfaceType'),
-                        'AvailabilityZone': eni.get('AvailabilityZone'),
-                        'Attachment': eni.get('Attachment')
-                    },
-                    remediation_action="Investigate ENI usage and owner, detach/delete if unused"
-                ))
-            
+            response = self.ec2_client.describe_network_interfaces(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])
+
+            eni_count = len(response["NetworkInterfaces"])
+
+            for eni in response["NetworkInterfaces"]:
+                result.dependencies.append(
+                    VPCDependency(
+                        resource_type="NetworkInterface",
+                        resource_id=eni["NetworkInterfaceId"],
+                        resource_name=eni.get("Description", "Unknown"),
+                        dependency_type="blocking",
+                        details={
+                            "Status": eni.get("Status"),
+                            "InterfaceType": eni.get("InterfaceType"),
+                            "AvailabilityZone": eni.get("AvailabilityZone"),
+                            "Attachment": eni.get("Attachment"),
+                        },
+                        remediation_action="Investigate ENI usage and owner, detach/delete if unused",
+                    )
+                )
+
             return eni_count
-            
+
         except ClientError as e:
             print_warning(f"ENI analysis failed: {e}")
             return -1
-    
+
     def _analyze_nat_gateways(self, vpc_id: str, result: VPCDependencyAnalysisResult):
         """Step 2.1: NAT Gateway dependency analysis."""
         try:
-            response = self.ec2_client.describe_nat_gateways(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]
-            )
-            
-            for nat_gw in response['NatGateways']:
-                if nat_gw['State'] in ['available', 'pending']:
-                    result.dependencies.append(VPCDependency(
-                        resource_type="NatGateway",
-                        resource_id=nat_gw['NatGatewayId'],
-                        dependency_type="blocking",
-                        details={
-                            'State': nat_gw['State'],
-                            'SubnetId': nat_gw['SubnetId'],
-                            'NatGatewayAddresses': nat_gw.get('NatGatewayAddresses', [])
-                        },
-                        remediation_action="Delete NAT Gateway, then update route tables"
-                    ))
-                    
+            response = self.ec2_client.describe_nat_gateways(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])
+
+            for nat_gw in response["NatGateways"]:
+                if nat_gw["State"] in ["available", "pending"]:
+                    result.dependencies.append(
+                        VPCDependency(
+                            resource_type="NatGateway",
+                            resource_id=nat_gw["NatGatewayId"],
+                            dependency_type="blocking",
+                            details={
+                                "State": nat_gw["State"],
+                                "SubnetId": nat_gw["SubnetId"],
+                                "NatGatewayAddresses": nat_gw.get("NatGatewayAddresses", []),
+                            },
+                            remediation_action="Delete NAT Gateway, then update route tables",
+                        )
+                    )
+
         except ClientError as e:
             print_warning(f"NAT Gateway analysis failed: {e}")
-    
+
     def _analyze_internet_gateways(self, vpc_id: str, result: VPCDependencyAnalysisResult):
         """Step 2.2: Internet Gateway dependency analysis."""
         try:
             response = self.ec2_client.describe_internet_gateways(
-                Filters=[{'Name': 'attachment.vpc-id', 'Values': [vpc_id]}]
+                Filters=[{"Name": "attachment.vpc-id", "Values": [vpc_id]}]
             )
-            
-            for igw in response['InternetGateways']:
-                result.dependencies.append(VPCDependency(
-                    resource_type="InternetGateway", 
-                    resource_id=igw['InternetGatewayId'],
-                    dependency_type="blocking",
-                    details={'Attachments': igw.get('Attachments', [])},
-                    remediation_action="Detach and delete Internet Gateway"
-                ))
-                
+
+            for igw in response["InternetGateways"]:
+                result.dependencies.append(
+                    VPCDependency(
+                        resource_type="InternetGateway",
+                        resource_id=igw["InternetGatewayId"],
+                        dependency_type="blocking",
+                        details={"Attachments": igw.get("Attachments", [])},
+                        remediation_action="Detach and delete Internet Gateway",
+                    )
+                )
+
         except ClientError as e:
             print_warning(f"Internet Gateway analysis failed: {e}")
-    
+
     def _analyze_route_tables(self, vpc_id: str, result: VPCDependencyAnalysisResult):
         """Step 2.3: Route table dependency analysis."""
         try:
-            response = self.ec2_client.describe_route_tables(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]
-            )
-            
-            for rt in response['RouteTables']:
+            response = self.ec2_client.describe_route_tables(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])
+
+            for rt in response["RouteTables"]:
                 # Skip main route table (automatically deleted with VPC)
-                main_rt = any(assoc.get('Main') for assoc in rt.get('Associations', []))
+                main_rt = any(assoc.get("Main") for assoc in rt.get("Associations", []))
                 if not main_rt:
-                    result.dependencies.append(VPCDependency(
-                        resource_type="RouteTable",
-                        resource_id=rt['RouteTableId'],
-                        dependency_type="blocking",
-                        details={
-                            'Routes': rt.get('Routes', []),
-                            'Associations': rt.get('Associations', [])
-                        },
-                        remediation_action="Disassociate and delete non-main route tables"
-                    ))
-                    
+                    result.dependencies.append(
+                        VPCDependency(
+                            resource_type="RouteTable",
+                            resource_id=rt["RouteTableId"],
+                            dependency_type="blocking",
+                            details={"Routes": rt.get("Routes", []), "Associations": rt.get("Associations", [])},
+                            remediation_action="Disassociate and delete non-main route tables",
+                        )
+                    )
+
         except ClientError as e:
             print_warning(f"Route table analysis failed: {e}")
-    
+
     def _analyze_vpc_endpoints(self, vpc_id: str, result: VPCDependencyAnalysisResult):
         """Step 2.4: VPC Endpoints dependency analysis."""
         try:
-            response = self.ec2_client.describe_vpc_endpoints(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]
-            )
-            
-            for endpoint in response['VpcEndpoints']:
-                if endpoint['State'] == 'available':
-                    result.dependencies.append(VPCDependency(
-                        resource_type="VpcEndpoint",
-                        resource_id=endpoint['VpcEndpointId'],
-                        dependency_type="blocking",
-                        details={
-                            'VpcEndpointType': endpoint.get('VpcEndpointType'),
-                            'ServiceName': endpoint.get('ServiceName'),
-                            'State': endpoint['State']
-                        },
-                        remediation_action="Delete VPC Endpoint"
-                    ))
-                    
+            response = self.ec2_client.describe_vpc_endpoints(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])
+
+            for endpoint in response["VpcEndpoints"]:
+                if endpoint["State"] == "available":
+                    result.dependencies.append(
+                        VPCDependency(
+                            resource_type="VpcEndpoint",
+                            resource_id=endpoint["VpcEndpointId"],
+                            dependency_type="blocking",
+                            details={
+                                "VpcEndpointType": endpoint.get("VpcEndpointType"),
+                                "ServiceName": endpoint.get("ServiceName"),
+                                "State": endpoint["State"],
+                            },
+                            remediation_action="Delete VPC Endpoint",
+                        )
+                    )
+
         except ClientError as e:
             print_warning(f"VPC Endpoints analysis failed: {e}")
-    
+
     def _analyze_transit_gateway_attachments(self, vpc_id: str, result: VPCDependencyAnalysisResult):
         """Step 2.5: Transit Gateway attachment analysis."""
         try:
             response = self.ec2_client.describe_transit_gateway_attachments(
-                Filters=[
-                    {'Name': 'resource-id', 'Values': [vpc_id]},
-                    {'Name': 'resource-type', 'Values': ['vpc']}
-                ]
+                Filters=[{"Name": "resource-id", "Values": [vpc_id]}, {"Name": "resource-type", "Values": ["vpc"]}]
             )
-            
-            for attachment in response['TransitGatewayAttachments']:
-                if attachment['State'] in ['available', 'pending']:
-                    result.dependencies.append(VPCDependency(
-                        resource_type="TransitGatewayAttachment",
-                        resource_id=attachment['TransitGatewayAttachmentId'],
-                        dependency_type="blocking",
-                        details={
-                            'TransitGatewayId': attachment.get('TransitGatewayId'),
-                            'State': attachment['State']
-                        },
-                        remediation_action="Delete Transit Gateway VPC attachment"
-                    ))
-                    
+
+            for attachment in response["TransitGatewayAttachments"]:
+                if attachment["State"] in ["available", "pending"]:
+                    result.dependencies.append(
+                        VPCDependency(
+                            resource_type="TransitGatewayAttachment",
+                            resource_id=attachment["TransitGatewayAttachmentId"],
+                            dependency_type="blocking",
+                            details={
+                                "TransitGatewayId": attachment.get("TransitGatewayId"),
+                                "State": attachment["State"],
+                            },
+                            remediation_action="Delete Transit Gateway VPC attachment",
+                        )
+                    )
+
         except ClientError as e:
             print_warning(f"Transit Gateway analysis failed: {e}")
-    
+
     def _analyze_vpc_peering(self, vpc_id: str, result: VPCDependencyAnalysisResult):
         """Step 2.6: VPC Peering connection analysis."""
         try:
             response = self.ec2_client.describe_vpc_peering_connections(
-                Filters=[
-                    {'Name': 'accepter-vpc-info.vpc-id', 'Values': [vpc_id]}
-                ]
+                Filters=[{"Name": "accepter-vpc-info.vpc-id", "Values": [vpc_id]}]
             )
-            
+
             # Also check requester side
             response2 = self.ec2_client.describe_vpc_peering_connections(
-                Filters=[
-                    {'Name': 'requester-vpc-info.vpc-id', 'Values': [vpc_id]}
-                ]
+                Filters=[{"Name": "requester-vpc-info.vpc-id", "Values": [vpc_id]}]
             )
-            
-            all_connections = response['VpcPeeringConnections'] + response2['VpcPeeringConnections']
-            
+
+            all_connections = response["VpcPeeringConnections"] + response2["VpcPeeringConnections"]
+
             for conn in all_connections:
-                if conn['Status']['Code'] == 'active':
-                    result.dependencies.append(VPCDependency(
-                        resource_type="VpcPeeringConnection",
-                        resource_id=conn['VpcPeeringConnectionId'],
-                        dependency_type="blocking",
-                        details={'Status': conn['Status']},
-                        remediation_action="Delete VPC Peering connection"
-                    ))
-                    
+                if conn["Status"]["Code"] == "active":
+                    result.dependencies.append(
+                        VPCDependency(
+                            resource_type="VpcPeeringConnection",
+                            resource_id=conn["VpcPeeringConnectionId"],
+                            dependency_type="blocking",
+                            details={"Status": conn["Status"]},
+                            remediation_action="Delete VPC Peering connection",
+                        )
+                    )
+
         except ClientError as e:
             print_warning(f"VPC Peering analysis failed: {e}")
-    
+
     def _analyze_route53_resolver(self, vpc_id: str, result: VPCDependencyAnalysisResult):
         """Step 2.7: Route53 Resolver endpoint analysis."""
         try:
             response = self.route53resolver_client.list_resolver_endpoints()
-            
-            for endpoint in response['ResolverEndpoints']:
-                if vpc_id in [ip['VpcId'] for ip in endpoint.get('IpAddresses', [])]:
-                    result.dependencies.append(VPCDependency(
-                        resource_type="ResolverEndpoint",
-                        resource_id=endpoint['Id'],
-                        resource_name=endpoint.get('Name'),
-                        dependency_type="blocking",
-                        details={
-                            'Direction': endpoint.get('Direction'),
-                            'IpAddressCount': endpoint.get('IpAddressCount')
-                        },
-                        remediation_action="Delete Route53 Resolver endpoint"
-                    ))
-                    
+
+            for endpoint in response["ResolverEndpoints"]:
+                if vpc_id in [ip["VpcId"] for ip in endpoint.get("IpAddresses", [])]:
+                    result.dependencies.append(
+                        VPCDependency(
+                            resource_type="ResolverEndpoint",
+                            resource_id=endpoint["Id"],
+                            resource_name=endpoint.get("Name"),
+                            dependency_type="blocking",
+                            details={
+                                "Direction": endpoint.get("Direction"),
+                                "IpAddressCount": endpoint.get("IpAddressCount"),
+                            },
+                            remediation_action="Delete Route53 Resolver endpoint",
+                        )
+                    )
+
         except ClientError as e:
             print_warning(f"Route53 Resolver analysis failed: {e}")
-    
+
     def _analyze_load_balancers(self, vpc_id: str, result: VPCDependencyAnalysisResult):
         """Step 2.8: Load Balancer dependency analysis."""
         try:
             response = self.elbv2_client.describe_load_balancers()
-            
-            for lb in response['LoadBalancers']:
-                if lb['VpcId'] == vpc_id and lb['State']['Code'] == 'active':
-                    result.dependencies.append(VPCDependency(
-                        resource_type="LoadBalancer",
-                        resource_id=lb['LoadBalancerArn'],
-                        resource_name=lb['LoadBalancerName'],
-                        dependency_type="blocking",
-                        details={
-                            'Type': lb['Type'],
-                            'State': lb['State'],
-                            'Scheme': lb.get('Scheme')
-                        },
-                        remediation_action="Delete Load Balancer"
-                    ))
-                    
+
+            for lb in response["LoadBalancers"]:
+                if lb["VpcId"] == vpc_id and lb["State"]["Code"] == "active":
+                    result.dependencies.append(
+                        VPCDependency(
+                            resource_type="LoadBalancer",
+                            resource_id=lb["LoadBalancerArn"],
+                            resource_name=lb["LoadBalancerName"],
+                            dependency_type="blocking",
+                            details={"Type": lb["Type"], "State": lb["State"], "Scheme": lb.get("Scheme")},
+                            remediation_action="Delete Load Balancer",
+                        )
+                    )
+
         except ClientError as e:
             print_warning(f"Load Balancer analysis failed: {e}")
-    
+
     def _analyze_database_subnet_groups(self, vpc_id: str, result: VPCDependencyAnalysisResult):
         """Step 2.9: Database subnet group analysis."""
         try:
             response = self.rds_client.describe_db_subnet_groups()
-            
-            for group in response['DBSubnetGroups']:
-                if group['VpcId'] == vpc_id:
-                    result.dependencies.append(VPCDependency(
-                        resource_type="DBSubnetGroup",
-                        resource_id=group['DBSubnetGroupName'],
-                        dependency_type="warning",  # Not always blocking
-                        details={
-                            'SubnetIds': [subnet['SubnetIdentifier'] for subnet in group['Subnets']]
-                        },
-                        remediation_action="Delete or reassign DB Subnet Group"
-                    ))
-                    
+
+            for group in response["DBSubnetGroups"]:
+                if group["VpcId"] == vpc_id:
+                    result.dependencies.append(
+                        VPCDependency(
+                            resource_type="DBSubnetGroup",
+                            resource_id=group["DBSubnetGroupName"],
+                            dependency_type="warning",  # Not always blocking
+                            details={"SubnetIds": [subnet["SubnetIdentifier"] for subnet in group["Subnets"]]},
+                            remediation_action="Delete or reassign DB Subnet Group",
+                        )
+                    )
+
         except ClientError as e:
             print_warning(f"Database subnet group analysis failed: {e}")
-    
+
     def _analyze_vpc_flow_logs(self, vpc_id: str, result: VPCDependencyAnalysisResult):
-        """Step 2.10: VPC Flow Logs analysis.""" 
+        """Step 2.10: VPC Flow Logs analysis."""
         try:
             response = self.ec2_client.describe_flow_logs(
-                Filters=[
-                    {'Name': 'resource-id', 'Values': [vpc_id]},
-                    {'Name': 'resource-type', 'Values': ['VPC']}
-                ]
+                Filters=[{"Name": "resource-id", "Values": [vpc_id]}, {"Name": "resource-type", "Values": ["VPC"]}]
             )
-            
-            for flow_log in response['FlowLogs']:
-                if flow_log['FlowLogStatus'] == 'ACTIVE':
-                    result.dependencies.append(VPCDependency(
-                        resource_type="FlowLog",
-                        resource_id=flow_log['FlowLogId'],
-                        dependency_type="informational",  # Clean up but not blocking
-                        details={
-                            'LogDestinationType': flow_log.get('LogDestinationType'),
-                            'LogDestination': flow_log.get('LogDestination')
-                        },
-                        remediation_action="Delete Flow Log (data retention handled)"
-                    ))
-                    
+
+            for flow_log in response["FlowLogs"]:
+                if flow_log["FlowLogStatus"] == "ACTIVE":
+                    result.dependencies.append(
+                        VPCDependency(
+                            resource_type="FlowLog",
+                            resource_id=flow_log["FlowLogId"],
+                            dependency_type="informational",  # Clean up but not blocking
+                            details={
+                                "LogDestinationType": flow_log.get("LogDestinationType"),
+                                "LogDestination": flow_log.get("LogDestination"),
+                            },
+                            remediation_action="Delete Flow Log (data retention handled)",
+                        )
+                    )
+
         except ClientError as e:
             print_warning(f"VPC Flow Logs analysis failed: {e}")
-    
+
     def _analyze_security_groups_nacls(self, vpc_id: str, result: VPCDependencyAnalysisResult):
         """Step 2.11: Security Groups and NACLs analysis."""
         try:
             # Security Groups
-            sg_response = self.ec2_client.describe_security_groups(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]
-            )
-            
-            for sg in sg_response['SecurityGroups']:
-                if sg['GroupName'] != 'default':  # Skip default SG (auto-deleted)
-                    result.dependencies.append(VPCDependency(
-                        resource_type="SecurityGroup",
-                        resource_id=sg['GroupId'],
-                        resource_name=sg['GroupName'],
-                        dependency_type="blocking",
-                        details={'Description': sg.get('Description')},
-                        remediation_action="Delete non-default Security Groups"
-                    ))
-            
+            sg_response = self.ec2_client.describe_security_groups(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])
+
+            for sg in sg_response["SecurityGroups"]:
+                if sg["GroupName"] != "default":  # Skip default SG (auto-deleted)
+                    result.dependencies.append(
+                        VPCDependency(
+                            resource_type="SecurityGroup",
+                            resource_id=sg["GroupId"],
+                            resource_name=sg["GroupName"],
+                            dependency_type="blocking",
+                            details={"Description": sg.get("Description")},
+                            remediation_action="Delete non-default Security Groups",
+                        )
+                    )
+
             # Network ACLs
-            nacl_response = self.ec2_client.describe_network_acls(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]
-            )
-            
-            for nacl in nacl_response['NetworkAcls']:
-                if not nacl['IsDefault']:  # Skip default NACL (auto-deleted)
-                    result.dependencies.append(VPCDependency(
-                        resource_type="NetworkAcl",
-                        resource_id=nacl['NetworkAclId'],
-                        dependency_type="blocking",
-                        details={'Associations': nacl.get('Associations', [])},
-                        remediation_action="Delete non-default Network ACLs"
-                    ))
-                    
+            nacl_response = self.ec2_client.describe_network_acls(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])
+
+            for nacl in nacl_response["NetworkAcls"]:
+                if not nacl["IsDefault"]:  # Skip default NACL (auto-deleted)
+                    result.dependencies.append(
+                        VPCDependency(
+                            resource_type="NetworkAcl",
+                            resource_id=nacl["NetworkAclId"],
+                            dependency_type="blocking",
+                            details={"Associations": nacl.get("Associations", [])},
+                            remediation_action="Delete non-default Network ACLs",
+                        )
+                    )
+
         except ClientError as e:
             print_warning(f"Security Groups/NACLs analysis failed: {e}")
-    
+
     def _generate_cleanup_recommendation(self, result: VPCDependencyAnalysisResult):
         """Generate cleanup recommendation based on dependency analysis."""
         if result.eni_count > 0:
             result.cleanup_recommendation = "INVESTIGATE"
             result.security_impact = "HIGH"
             result.compliance_impact = ["INVESTIGATE_WORKLOADS", "VALIDATE_ENI_OWNERS"]
-            
+
         elif result.blocking_dependencies == 0:
             result.cleanup_recommendation = "DELETE"
             result.security_impact = "LOW" if not result.is_default else "MEDIUM"
             result.estimated_monthly_savings = 50.0  # Estimated VPC-related cost savings
-            
+
             if result.is_default:
                 result.compliance_impact = ["CIS_BENCHMARK_IMPROVEMENT", "ATTACK_SURFACE_REDUCTION"]
-            
+
         elif result.blocking_dependencies <= 3:
             result.cleanup_recommendation = "DELETE_WITH_CLEANUP"
             result.security_impact = "MEDIUM"
             result.estimated_monthly_savings = 25.0
             result.compliance_impact = ["REQUIRES_DEPENDENCY_CLEANUP"]
-            
+
         else:
             result.cleanup_recommendation = "HOLD"
             result.security_impact = "HIGH"
             result.compliance_impact = ["COMPLEX_DEPENDENCIES", "REQUIRES_DETAILED_ANALYSIS"]
-    
+
     def _display_analysis_results(self, result: VPCDependencyAnalysisResult):
         """Display comprehensive analysis results with Rich formatting."""
-        
+
         # Summary Panel
         summary_table = Table(title="AWSO-5 VPC Analysis Summary")
         summary_table.add_column("Metric", style="cyan", no_wrap=True)
         summary_table.add_column("Value", style="green")
         summary_table.add_column("Impact", style="yellow")
-        
+
         summary_table.add_row("VPC ID", result.vpc_id, "")
-        summary_table.add_row("Default VPC", "Yes" if result.is_default else "No", 
-                             "Security Risk" if result.is_default else "Normal")
-        summary_table.add_row("ENI Count", str(result.eni_count), 
-                             "BLOCKING" if result.eni_count > 0 else "OK")
+        summary_table.add_row(
+            "Default VPC", "Yes" if result.is_default else "No", "Security Risk" if result.is_default else "Normal"
+        )
+        summary_table.add_row("ENI Count", str(result.eni_count), "BLOCKING" if result.eni_count > 0 else "OK")
         summary_table.add_row("Total Dependencies", str(len(result.dependencies)), "")
-        summary_table.add_row("Blocking Dependencies", str(result.blocking_dependencies), 
-                             "REQUIRES_CLEANUP" if result.blocking_dependencies > 0 else "OK")
+        summary_table.add_row(
+            "Blocking Dependencies",
+            str(result.blocking_dependencies),
+            "REQUIRES_CLEANUP" if result.blocking_dependencies > 0 else "OK",
+        )
         summary_table.add_row("Recommendation", result.cleanup_recommendation, result.security_impact)
         summary_table.add_row("Analysis Duration", f"{result.analysis_duration_seconds:.2f}s", "")
-        
+
         self.console.print("\n")
         self.console.print(summary_table)
-        
+
         # Dependencies Detail
         if result.dependencies:
-            deps_table = create_table(title="Dependency Analysis Details", 
-                                    columns=["Resource Type", "Resource ID", "Dependency Type", "Remediation Action"])
-            
+            deps_table = create_table(
+                title="Dependency Analysis Details",
+                columns=["Resource Type", "Resource ID", "Dependency Type", "Remediation Action"],
+            )
+
             for dep in result.dependencies:
                 deps_table.add_row(
                     dep.resource_type,
                     dep.resource_id,
                     dep.dependency_type.upper(),
-                    dep.remediation_action or "Manual review required"
+                    dep.remediation_action or "Manual review required",
                 )
-            
+
             self.console.print("\n")
             self.console.print(deps_table)
-        
+
         # Recommendation Panel
         if result.cleanup_recommendation == "DELETE":
             status = "[green]✅ SAFE TO DELETE[/green]"
@@ -697,149 +703,147 @@ class VPCDependencyAnalyzer:
             status = "[red]⚠️ INVESTIGATE REQUIRED[/red]"
         else:
             status = "[yellow]⚠️ CLEANUP REQUIRED[/yellow]"
-        
+
         recommendation_text = f"""
 {status}
 
 **Complexity:** {result.deletion_complexity}
 **Estimated Savings:** ${result.estimated_monthly_savings:.2f}/month
 **Security Impact:** {result.security_impact}
-**Compliance Impact:** {', '.join(result.compliance_impact) if result.compliance_impact else 'None'}
+**Compliance Impact:** {", ".join(result.compliance_impact) if result.compliance_impact else "None"}
 
 **Next Steps:**
 {self._get_next_steps(result)}
         """
-        
-        recommendation_panel = Panel(
-            recommendation_text,
-            title="🎯 AWSO-5 Cleanup Recommendation",
-            border_style="blue"
-        )
-        
+
+        recommendation_panel = Panel(recommendation_text, title="🎯 AWSO-5 Cleanup Recommendation", border_style="blue")
+
         self.console.print("\n")
         self.console.print(recommendation_panel)
-        
+
         if result.can_delete_safely:
             print_success("✅ VPC ready for deletion - zero blocking dependencies")
         else:
             print_warning(f"⚠️  {result.blocking_dependencies} blocking dependencies require resolution")
-    
+
     def _get_next_steps(self, result: VPCDependencyAnalysisResult) -> str:
         """Generate next steps based on analysis results."""
         if result.cleanup_recommendation == "DELETE":
             return "• Execute VPC deletion via operate.vpc.delete()\n• Generate evidence bundle\n• Update compliance documentation"
-        
+
         elif result.cleanup_recommendation == "INVESTIGATE":
             return "• Investigate ENI owners and usage\n• Validate workload requirements\n• Coordinate with application teams"
-        
+
         elif result.cleanup_recommendation == "DELETE_WITH_CLEANUP":
             return "• Execute dependency cleanup plan\n• Re-run dependency analysis\n• Proceed with VPC deletion when clear"
-        
+
         else:  # HOLD
             return "• Detailed dependency analysis required\n• Stakeholder coordination needed\n• Consider migration vs cleanup options"
-    
+
     def generate_evidence_bundle(self, vpc_ids: List[str]) -> Dict[str, Any]:
         """
         Generate SHA256-verified evidence bundle for AWSO-5 compliance.
-        
+
         Args:
             vpc_ids: List of VPC IDs to include in evidence bundle
-            
+
         Returns:
             Evidence bundle with manifest and hashes
         """
         evidence_bundle = {
-            'metadata': {
-                'analysis_framework': 'AWSO-5',
-                'version': '1.0.0',
-                'timestamp': datetime.utcnow().isoformat(),
-                'region': self.region,
-                'analyst': 'python-runbooks-engineer'
+            "metadata": {
+                "analysis_framework": "AWSO-5",
+                "version": "1.0.0",
+                "timestamp": datetime.utcnow().isoformat(),
+                "region": self.region,
+                "analyst": "python-runbooks-engineer",
             },
-            'vpc_analyses': {},
-            'summary': {
-                'total_vpcs_analyzed': 0,
-                'safe_to_delete': 0,
-                'requires_investigation': 0,
-                'requires_cleanup': 0,
-                'total_estimated_savings': 0.0
+            "vpc_analyses": {},
+            "summary": {
+                "total_vpcs_analyzed": 0,
+                "safe_to_delete": 0,
+                "requires_investigation": 0,
+                "requires_cleanup": 0,
+                "total_estimated_savings": 0.0,
             },
-            'manifest': []
+            "manifest": [],
         }
-        
+
         for vpc_id in vpc_ids:
             if vpc_id in self.analysis_results:
                 result = self.analysis_results[vpc_id]
-                evidence_bundle['vpc_analyses'][vpc_id] = {
-                    'analysis_result': result.__dict__,
-                    'evidence_hash': self._calculate_evidence_hash(result)
+                evidence_bundle["vpc_analyses"][vpc_id] = {
+                    "analysis_result": result.__dict__,
+                    "evidence_hash": self._calculate_evidence_hash(result),
                 }
-                
-                evidence_bundle['summary']['total_vpcs_analyzed'] += 1
+
+                evidence_bundle["summary"]["total_vpcs_analyzed"] += 1
                 if result.cleanup_recommendation == "DELETE":
-                    evidence_bundle['summary']['safe_to_delete'] += 1
+                    evidence_bundle["summary"]["safe_to_delete"] += 1
                 elif result.cleanup_recommendation == "INVESTIGATE":
-                    evidence_bundle['summary']['requires_investigation'] += 1
+                    evidence_bundle["summary"]["requires_investigation"] += 1
                 else:
-                    evidence_bundle['summary']['requires_cleanup'] += 1
-                    
-                evidence_bundle['summary']['total_estimated_savings'] += result.estimated_monthly_savings
-        
+                    evidence_bundle["summary"]["requires_cleanup"] += 1
+
+                evidence_bundle["summary"]["total_estimated_savings"] += result.estimated_monthly_savings
+
         # Generate bundle hash
         bundle_content = json.dumps(evidence_bundle, sort_keys=True, default=str)
         bundle_hash = hashlib.sha256(bundle_content.encode()).hexdigest()
-        evidence_bundle['bundle_hash'] = bundle_hash
-        
+        evidence_bundle["bundle_hash"] = bundle_hash
+
         print_success(f"Evidence bundle generated with hash: {bundle_hash[:16]}...")
-        
+
         return evidence_bundle
-    
+
     def _calculate_evidence_hash(self, result: VPCDependencyAnalysisResult) -> str:
         """Calculate SHA256 hash for analysis result."""
         result_json = json.dumps(result.__dict__, sort_keys=True, default=str)
         return hashlib.sha256(result_json.encode()).hexdigest()
 
 
-def analyze_vpc_dependencies_cli(vpc_id: str, profile: Optional[str] = None, region: str = "us-east-1") -> VPCDependencyAnalysisResult:
+def analyze_vpc_dependencies_cli(
+    vpc_id: str, profile: Optional[str] = None, region: str = "us-east-1"
+) -> VPCDependencyAnalysisResult:
     """
     CLI wrapper for VPC dependency analysis.
-    
+
     Args:
         vpc_id: AWS VPC identifier
         profile: AWS profile name
         region: AWS region
-        
+
     Returns:
         Comprehensive dependency analysis results
     """
     session = boto3.Session(profile_name=profile) if profile else boto3.Session()
     analyzer = VPCDependencyAnalyzer(session=session, region=region)
-    
+
     return analyzer.analyze_vpc_dependencies(vpc_id)
 
 
 if __name__ == "__main__":
     import argparse
-    
+
     parser = argparse.ArgumentParser(description="AWSO-5 VPC Dependency Analysis")
     parser.add_argument("--vpc-id", required=True, help="VPC ID to analyze")
     parser.add_argument("--profile", help="AWS profile name")
     parser.add_argument("--region", default="us-east-1", help="AWS region")
     parser.add_argument("--evidence-bundle", action="store_true", help="Generate evidence bundle")
-    
+
     args = parser.parse_args()
-    
+
     result = analyze_vpc_dependencies_cli(args.vpc_id, args.profile, args.region)
-    
+
     if args.evidence_bundle:
         analyzer = VPCDependencyAnalyzer(region=args.region)
         bundle = analyzer.generate_evidence_bundle([args.vpc_id])
-        
+
         # Save evidence bundle
         timestamp = datetime.utcnow().strftime("%Y%m%d_%H%M%S")
         bundle_filename = f"vpc_evidence_bundle_{timestamp}.json"
-        
-        with open(bundle_filename, 'w') as f:
+
+        with open(bundle_filename, "w") as f:
             json.dump(bundle, f, indent=2, default=str)
-        
-        print_success(f"Evidence bundle saved: {bundle_filename}")
+
+        print_success(f"Evidence bundle saved: {bundle_filename}")