runbooks 1.1.4__py3-none-any.whl → 1.1.6__py3-none-any.whl

runbooks/inventory/vpc_analyzer.py

@@ -34,9 +34,9 @@ import asyncio
 
 import boto3
 from botocore.exceptions import ClientError
-from rich.console import Console
 from rich.panel import Panel
-from rich.progress import Progress, SpinnerColumn, TextColumn
+from rich.progress import SpinnerColumn, TextColumn
+from runbooks.common.rich_utils import Progress
 from rich.table import Table
 from rich.tree import Tree
 
@@ -44,6 +44,7 @@ from runbooks.common.profile_utils import create_operational_session
 from runbooks.common.cross_account_manager import EnhancedCrossAccountManager, CrossAccountSession
 from runbooks.common.organizations_client import OrganizationAccount, get_unified_organizations_client
 from runbooks.common.rich_utils import (
+    Console,
     console,
     print_header,
     print_success,
@@ -52,7 +53,7 @@ from runbooks.common.rich_utils import (
     print_info,
     create_table,
     create_progress_bar,
-    format_cost
+    format_cost,
 )
 
 logger = logging.getLogger(__name__)
@@ -61,6 +62,7 @@ logger = logging.getLogger(__name__)
 @dataclass
 class VPCDiscoveryResult:
     """Results from VPC discovery operations"""
+
     vpcs: List[Dict[str, Any]]
     nat_gateways: List[Dict[str, Any]]
     vpc_endpoints: List[Dict[str, Any]]
@@ -80,6 +82,7 @@ class VPCDiscoveryResult:
 @dataclass
 class AWSOAnalysis:
     """AWSO-05 specific analysis results"""
+
     default_vpcs: List[Dict[str, Any]]
     orphaned_resources: List[Dict[str, Any]]
     dependency_chain: Dict[str, List[str]]
@@ -91,7 +94,7 @@ class AWSOAnalysis:
 class VPCAnalyzer:
     """
     Enterprise VPC Discovery and Analysis Engine
-    
+
     Migrated from VPC module with enhanced capabilities:
     - Complete VPC topology discovery
     - AWSO-05 cleanup support with 12-step dependency analysis
@@ -106,13 +109,13 @@ class VPCAnalyzer:
         region: Optional[str] = "us-east-1",
         console: Optional[Console] = None,
         dry_run: bool = True,
-        excluded_accounts: Optional[List[str]] = None,  # Enhanced: Decommissioned accounts filtering  
+        excluded_accounts: Optional[List[str]] = None,  # Enhanced: Decommissioned accounts filtering
         enable_multi_account: bool = False,  # Enhanced: Multi-Organization Landing Zone mode
-        max_workers: int = 10  # Enhanced: Parallel processing for 60-account operations
+        max_workers: int = 10,  # Enhanced: Parallel processing for 60-account operations
     ):
         """
         Initialize VPC Analyzer with enterprise profile management and 60-account Landing Zone support
-        
+
         Args:
             profile: AWS profile name (3-tier priority: User > Environment > Default)
             region: AWS region for analysis (defaults to us-east-1)
@@ -127,189 +130,186 @@ class VPCAnalyzer:
         self.console = console or Console()
         self.dry_run = dry_run
         self.max_workers = max_workers
-        
+
         # Decommissioned account filtering (default: account 294618320542)
         self.excluded_accounts = excluded_accounts or ["294618320542"]
         self.enable_multi_account = enable_multi_account
-        
+
         # Initialize AWS session using enterprise profile management
         self.session = None
         if profile:
             try:
-                self.session = create_operational_session(profile=profile)
+                self.session = create_operational_session(profile_name=profile)
                 print_success(f"Connected to AWS profile: {profile}")
             except Exception as e:
                 print_error(f"Failed to connect to AWS: {e}")
-        
+
         # NEW: Initialize Enhanced Cross-Account Manager for 60-account operations
         self.cross_account_manager = None
         if enable_multi_account:
             self.cross_account_manager = EnhancedCrossAccountManager(
                 base_profile=profile,
                 max_workers=max_workers,
-                session_ttl_minutes=240  # 4-hour TTL for enterprise operations
+                session_ttl_minutes=240,  # 4-hour TTL for enterprise operations
             )
             print_info(f"🌐 Multi-Organization Landing Zone mode enabled for {max_workers} parallel accounts")
             print_info(f"🚫 Excluded decommissioned accounts: {self.excluded_accounts}")
-        
+
         # Results storage
         self.last_discovery = None
         self.last_awso_analysis = None
         self.landing_zone_sessions = []  # Enhanced: Store cross-account sessions
-        
+
         print_header(f"VPC Analyzer latest version", "Multi-Organization Landing Zone Enhanced")
-        
+
         if self.enable_multi_account:
             print_info(f"🎯 Target: 60-account Multi-Organization Landing Zone discovery")
             print_info(f"⚡ Performance: <60s complete analysis with {max_workers} parallel workers")
             print_info(f"🔒 Session TTL: 4-hour enterprise standard with auto-refresh")
 
     def _filter_landing_zone_accounts(
-        self,
-        accounts: List[OrganizationAccount],
-        excluded_accounts: Optional[List[str]] = None
+        self, accounts: List[OrganizationAccount], excluded_accounts: Optional[List[str]] = None
     ) -> List[OrganizationAccount]:
         """
         Enhanced: Filter out decommissioned accounts from Landing Zone discovery
-        
+
         Args:
             accounts: List of organization accounts
             excluded_accounts: Additional accounts to exclude (merged with instance defaults)
-            
+
         Returns:
             Filtered list of active accounts for discovery
         """
         exclusion_list = (excluded_accounts or []) + (self.excluded_accounts or [])
-        
+
         # Remove duplicates while preserving order
         exclusion_list = list(dict.fromkeys(exclusion_list))
-        
+
         if not exclusion_list:
             return accounts
-        
+
         filtered_accounts = []
         excluded_count = 0
-        
+
         for account in accounts:
             if account.account_id in exclusion_list:
                 excluded_count += 1
                 print_info(f"🚫 Excluded decommissioned account: {account.account_id} ({account.name or 'Unknown'})")
             else:
                 filtered_accounts.append(account)
-        
+
         if excluded_count > 0:
             print_warning(f"⚠️  Excluded {excluded_count} decommissioned accounts from discovery")
             print_info(f"✅ Active accounts for discovery: {len(filtered_accounts)}")
-        
+
         return filtered_accounts
-    
+
     async def discover_multi_org_vpc_topology(
-        self,
-        target_accounts: int = 60,
-        landing_zone_structure: Optional[Dict] = None
+        self, target_accounts: int = 60, landing_zone_structure: Optional[Dict] = None
     ) -> VPCDiscoveryResult:
         """
         Enhanced: Discover VPC topology across Multi-Organization Landing Zone
-        
+
         This is the primary method for 60-account enterprise discovery operations.
-        
+
         Args:
             target_accounts: Expected number of accounts (default: 60)
             landing_zone_structure: Optional Landing Zone structure metadata
-            
+
         Returns:
             VPCDiscoveryResult with comprehensive multi-account topology
         """
         if not self.enable_multi_account or not self.cross_account_manager:
             raise ValueError("Multi-account mode not enabled. Initialize with enable_multi_account=True")
-        
+
         print_header("Multi-Organization Landing Zone VPC Discovery", f"Target: {target_accounts} accounts")
         start_time = time.time()
-        
+
         # Step 1: Discover and filter Landing Zone accounts
         print_info("🏢 Step 1: Discovering Landing Zone accounts...")
         try:
             sessions = await self.cross_account_manager.create_cross_account_sessions_from_organization()
-            
+
             # Extract accounts from sessions and filter decommissioned
             all_accounts = [
                 OrganizationAccount(
                     account_id=session.account_id,
                     name=session.account_name or session.account_id,
                     email="discovered@system",
-                    status="ACTIVE" if session.status in ['success', 'cached'] else "INACTIVE", 
-                    joined_method="DISCOVERED"
+                    status="ACTIVE" if session.status in ["success", "cached"] else "INACTIVE",
+                    joined_method="DISCOVERED",
                 )
                 for session in sessions
             ]
-            
+
             active_accounts = self._filter_landing_zone_accounts(all_accounts)
             successful_sessions = self.cross_account_manager.get_successful_sessions(sessions)
-            
-            print_success(f"✅ Landing Zone Discovery: {len(successful_sessions)}/{len(all_accounts)} accounts accessible")
-            
+
+            print_success(
+                f"✅ Landing Zone Discovery: {len(successful_sessions)}/{len(all_accounts)} accounts accessible"
+            )
+
         except Exception as e:
             print_error(f"❌ Failed to discover Landing Zone accounts: {e}")
             raise
-        
+
         # Step 2: Parallel VPC topology discovery
         print_info(f"🔍 Step 2: Parallel VPC discovery across {len(successful_sessions)} accounts...")
-        
+
         aggregated_results = await self._discover_vpc_topology_parallel(successful_sessions)
-        
+
         # Step 3: Generate comprehensive analytics
         discovery_time = time.time() - start_time
-        
+
         landing_zone_metrics = {
-            'total_accounts_discovered': len(all_accounts),
-            'successful_sessions': len(successful_sessions),
-            'excluded_accounts': len(all_accounts) - len(active_accounts),
-            'discovery_time_seconds': discovery_time,
-            'performance_target_met': discovery_time < 60.0,  # <60s target
-            'accounts_per_second': len(successful_sessions) / discovery_time if discovery_time > 0 else 0,
-            'session_ttl_hours': 4,  # Enhanced: 4-hour TTL
-            'parallel_workers': self.max_workers
+            "total_accounts_discovered": len(all_accounts),
+            "successful_sessions": len(successful_sessions),
+            "excluded_accounts": len(all_accounts) - len(active_accounts),
+            "discovery_time_seconds": discovery_time,
+            "performance_target_met": discovery_time < 60.0,  # <60s target
+            "accounts_per_second": len(successful_sessions) / discovery_time if discovery_time > 0 else 0,
+            "session_ttl_hours": 4,  # Enhanced: 4-hour TTL
+            "parallel_workers": self.max_workers,
         }
-        
+
         print_success(f"🎯 Multi-Organization Landing Zone Discovery Complete!")
         print_info(f"   📊 Performance: {discovery_time:.1f}s for {len(successful_sessions)} accounts")
         print_info(f"   ⚡ Rate: {landing_zone_metrics['accounts_per_second']:.1f} accounts/second")
-        print_info(f"   🎯 Target met: {'✅ Yes' if landing_zone_metrics['performance_target_met'] else '❌ No'} (<60s)")
-        
+        print_info(
+            f"   🎯 Target met: {'✅ Yes' if landing_zone_metrics['performance_target_met'] else '❌ No'} (<60s)"
+        )
+
         # Store sessions for future operations
         self.landing_zone_sessions = successful_sessions
-        
+
         # Enhanced result with Landing Zone metadata
         aggregated_results.landing_zone_metrics = landing_zone_metrics
         aggregated_results.account_summary = {
-            'total_accounts': len(successful_sessions),
-            'excluded_accounts_list': self.excluded_accounts,
-            'discovery_timestamp': datetime.now().isoformat(),
-            'landing_zone_structure': landing_zone_structure
+            "total_accounts": len(successful_sessions),
+            "excluded_accounts_list": self.excluded_accounts,
+            "discovery_timestamp": datetime.now().isoformat(),
+            "landing_zone_structure": landing_zone_structure,
         }
-        
+
         self.last_discovery = aggregated_results
         return aggregated_results
-    
-    async def _discover_vpc_topology_parallel(
-        self,
-        sessions: List[CrossAccountSession]
-    ) -> VPCDiscoveryResult:
+
+    async def _discover_vpc_topology_parallel(self, sessions: List[CrossAccountSession]) -> VPCDiscoveryResult:
         """
         Enhanced: Discover VPC topology across multiple accounts in parallel
-        
+
         Optimized for 60-account operations with <60s performance target.
-        
+
         Args:
             sessions: List of successful cross-account sessions
-            
+
         Returns:
             Aggregated VPCDiscoveryResult from all accounts
         """
         if not sessions:
             print_warning("⚠️  No successful sessions available for VPC discovery")
             return self._create_empty_discovery_result()
-        
+
         # Initialize aggregated results
         aggregated_vpcs = []
         aggregated_nat_gateways = []
@@ -321,49 +321,49 @@ class VPCAnalyzer:
         aggregated_transit_gateway_attachments = []
         aggregated_vpc_peering_connections = []
         aggregated_security_groups = []
-        
+
         total_resources = 0
-        
+
         # Create progress tracking
         with create_progress_bar() as progress:
             task = progress.add_task(f"VPC discovery across {len(sessions)} accounts...", total=len(sessions))
-            
+
             # Process accounts in parallel batches
             batch_size = min(self.max_workers, len(sessions))
-            
+
             for i in range(0, len(sessions), batch_size):
-                batch_sessions = sessions[i:i + batch_size]
+                batch_sessions = sessions[i : i + batch_size]
                 batch_tasks = []
-                
+
                 # Create async tasks for parallel processing
                 for session in batch_sessions:
                     task_coro = self._discover_single_account_vpc_topology(session)
                     batch_tasks.append(asyncio.create_task(task_coro))
-                
+
                 # Wait for batch completion
                 batch_results = await asyncio.gather(*batch_tasks, return_exceptions=True)
-                
+
                 # Process batch results
                 for idx, result in enumerate(batch_results):
                     session = batch_sessions[idx]
-                    
+
                     if isinstance(result, Exception):
                         print_warning(f"⚠️  Account {session.account_id} discovery failed: {result}")
                         progress.advance(task)
                         continue
-                    
+
                     if result:
                         # Aggregate resources with account context
                         for vpc in result.vpcs:
-                            vpc['source_account'] = session.account_id
-                            vpc['source_account_name'] = session.account_name
+                            vpc["source_account"] = session.account_id
+                            vpc["source_account_name"] = session.account_name
                         aggregated_vpcs.extend(result.vpcs)
-                        
+
                         for nat_gw in result.nat_gateways:
-                            nat_gw['source_account'] = session.account_id
-                            nat_gw['source_account_name'] = session.account_name
+                            nat_gw["source_account"] = session.account_id
+                            nat_gw["source_account_name"] = session.account_name
                         aggregated_nat_gateways.extend(result.nat_gateways)
-                        
+
                         # Add account context to all resource types
                         for resource_list, aggregated_list in [
                             (result.vpc_endpoints, aggregated_vpc_endpoints),
@@ -373,19 +373,21 @@ class VPCAnalyzer:
                             (result.network_interfaces, aggregated_network_interfaces),
                             (result.transit_gateway_attachments, aggregated_transit_gateway_attachments),
                             (result.vpc_peering_connections, aggregated_vpc_peering_connections),
-                            (result.security_groups, aggregated_security_groups)
+                            (result.security_groups, aggregated_security_groups),
                         ]:
                             for resource in resource_list:
-                                resource['source_account'] = session.account_id
-                                resource['source_account_name'] = session.account_name
+                                resource["source_account"] = session.account_id
+                                resource["source_account_name"] = session.account_name
                             aggregated_list.extend(resource_list)
-                        
+
                         total_resources += result.total_resources
-                    
+
                     progress.advance(task)
-        
-        print_success(f"🎯 Parallel VPC discovery complete: {total_resources} total resources across {len(sessions)} accounts")
-        
+
+        print_success(
+            f"🎯 Parallel VPC discovery complete: {total_resources} total resources across {len(sessions)} accounts"
+        )
+
         return VPCDiscoveryResult(
             vpcs=aggregated_vpcs,
             nat_gateways=aggregated_nat_gateways,
@@ -398,29 +400,26 @@ class VPCAnalyzer:
             vpc_peering_connections=aggregated_vpc_peering_connections,
             security_groups=aggregated_security_groups,
             total_resources=total_resources,
-            discovery_timestamp=datetime.now().isoformat()
+            discovery_timestamp=datetime.now().isoformat(),
         )
 
-    async def _discover_single_account_vpc_topology(
-        self,
-        session: CrossAccountSession
-    ) -> Optional[VPCDiscoveryResult]:
+    async def _discover_single_account_vpc_topology(self, session: CrossAccountSession) -> Optional[VPCDiscoveryResult]:
         """
         Discover VPC topology for a single account using cross-account session
-        
+
         Args:
             session: CrossAccountSession with valid AWS credentials
-            
+
         Returns:
             VPCDiscoveryResult for the account, or None if discovery fails
         """
-        if not session.session or session.status not in ['success', 'cached']:
+        if not session.session or session.status not in ["success", "cached"]:
             return None
-            
+
         try:
             # Create EC2 client with assumed role session
-            ec2_client = session.session.client('ec2', region_name=self.region)
-            
+            ec2_client = session.session.client("ec2", region_name=self.region)
+
             # Discover VPC resources
             vpcs = []
             nat_gateways = []
@@ -432,49 +431,63 @@ class VPCAnalyzer:
             transit_gateway_attachments = []
             vpc_peering_connections = []
             security_groups = []
-            
+
             # VPC Discovery
             vpc_response = ec2_client.describe_vpcs()
-            for vpc in vpc_response['Vpcs']:
-                vpcs.append({
-                    'VpcId': vpc['VpcId'],
-                    'State': vpc['State'],
-                    'CidrBlock': vpc['CidrBlock'],
-                    'IsDefault': vpc.get('IsDefault', False),
-                    'Tags': vpc.get('Tags', [])
-                })
-            
+            for vpc in vpc_response["Vpcs"]:
+                vpcs.append(
+                    {
+                        "VpcId": vpc["VpcId"],
+                        "State": vpc["State"],
+                        "CidrBlock": vpc["CidrBlock"],
+                        "IsDefault": vpc.get("IsDefault", False),
+                        "Tags": vpc.get("Tags", []),
+                    }
+                )
+
             # NAT Gateway Discovery
             nat_response = ec2_client.describe_nat_gateways()
-            for nat_gw in nat_response['NatGateways']:
-                nat_gateways.append({
-                    'NatGatewayId': nat_gw['NatGatewayId'],
-                    'VpcId': nat_gw.get('VpcId'),
-                    'State': nat_gw['State'],
-                    'SubnetId': nat_gw.get('SubnetId'),
-                    'Tags': nat_gw.get('Tags', [])
-                })
-            
+            for nat_gw in nat_response["NatGateways"]:
+                nat_gateways.append(
+                    {
+                        "NatGatewayId": nat_gw["NatGatewayId"],
+                        "VpcId": nat_gw.get("VpcId"),
+                        "State": nat_gw["State"],
+                        "SubnetId": nat_gw.get("SubnetId"),
+                        "Tags": nat_gw.get("Tags", []),
+                    }
+                )
+
             # Network Interfaces Discovery (for ENI gate analysis)
             eni_response = ec2_client.describe_network_interfaces()
-            for eni in eni_response['NetworkInterfaces']:
-                network_interfaces.append({
-                    'NetworkInterfaceId': eni['NetworkInterfaceId'],
-                    'VpcId': eni.get('VpcId'),
-                    'SubnetId': eni.get('SubnetId'),
-                    'Status': eni['Status'],
-                    'InterfaceType': eni.get('InterfaceType', 'interface'),
-                    'Attachment': eni.get('Attachment', {}),
-                    'Tags': eni.get('TagSet', [])
-                })
-            
+            for eni in eni_response["NetworkInterfaces"]:
+                network_interfaces.append(
+                    {
+                        "NetworkInterfaceId": eni["NetworkInterfaceId"],
+                        "VpcId": eni.get("VpcId"),
+                        "SubnetId": eni.get("SubnetId"),
+                        "Status": eni["Status"],
+                        "InterfaceType": eni.get("InterfaceType", "interface"),
+                        "Attachment": eni.get("Attachment", {}),
+                        "Tags": eni.get("TagSet", []),
+                    }
+                )
+
             # Continue with other resource types as needed...
-            
-            total_resources = (len(vpcs) + len(nat_gateways) + len(vpc_endpoints) +
-                             len(internet_gateways) + len(route_tables) + len(subnets) +
-                             len(network_interfaces) + len(transit_gateway_attachments) +
-                             len(vpc_peering_connections) + len(security_groups))
-            
+
+            total_resources = (
+                len(vpcs)
+                + len(nat_gateways)
+                + len(vpc_endpoints)
+                + len(internet_gateways)
+                + len(route_tables)
+                + len(subnets)
+                + len(network_interfaces)
+                + len(transit_gateway_attachments)
+                + len(vpc_peering_connections)
+                + len(security_groups)
+            )
+
             return VPCDiscoveryResult(
                 vpcs=vpcs,
                 nat_gateways=nat_gateways,
@@ -487,9 +500,9 @@ class VPCAnalyzer:
                 vpc_peering_connections=vpc_peering_connections,
                 security_groups=security_groups,
                 total_resources=total_resources,
-                discovery_timestamp=datetime.now().isoformat()
+                discovery_timestamp=datetime.now().isoformat(),
             )
-            
+
         except ClientError as e:
             print_warning(f"⚠️  AWS API error for account {session.account_id}: {e}")
             return None
@@ -511,69 +524,69 @@ class VPCAnalyzer:
             vpc_peering_connections=[],
             security_groups=[],
             total_resources=0,
-            discovery_timestamp=datetime.now().isoformat()
+            discovery_timestamp=datetime.now().isoformat(),
         )
 
     def discover_vpc_topology(self, vpc_ids: Optional[List[str]] = None) -> VPCDiscoveryResult:
         """
         Comprehensive VPC topology discovery for AWSO-05 support
-        
+
         Args:
             vpc_ids: Optional list of specific VPC IDs to analyze
-            
+
         Returns:
             VPCDiscoveryResult with complete topology information
         """
         print_header("VPC Topology Discovery", "AWSO-05 Enhanced")
-        
+
         if not self.session:
             print_error("No AWS session available")
             return self._empty_discovery_result()
-        
+
         with self.console.status("[bold green]Discovering VPC topology...") as status:
             try:
                 ec2 = self.session.client("ec2", region_name=self.region)
-                
+
                 # Discover VPCs
                 status.update("🔍 Discovering VPCs...")
                 vpcs = self._discover_vpcs(ec2, vpc_ids)
-                
-                # Discover NAT Gateways  
+
+                # Discover NAT Gateways
                 status.update("🌐 Discovering NAT Gateways...")
                 nat_gateways = self._discover_nat_gateways(ec2, vpc_ids)
-                
+
                 # Discover VPC Endpoints
                 status.update("🔗 Discovering VPC Endpoints...")
                 vpc_endpoints = self._discover_vpc_endpoints(ec2, vpc_ids)
-                
+
                 # Discover Internet Gateways
                 status.update("🌍 Discovering Internet Gateways...")
                 internet_gateways = self._discover_internet_gateways(ec2, vpc_ids)
-                
+
                 # Discover Route Tables
                 status.update("📋 Discovering Route Tables...")
                 route_tables = self._discover_route_tables(ec2, vpc_ids)
-                
+
                 # Discover Subnets
                 status.update("🏗️ Discovering Subnets...")
                 subnets = self._discover_subnets(ec2, vpc_ids)
-                
+
                 # Discover Network Interfaces (ENIs)
                 status.update("🔌 Discovering Network Interfaces...")
                 network_interfaces = self._discover_network_interfaces(ec2, vpc_ids)
-                
+
                 # Discover Transit Gateway Attachments
                 status.update("🚇 Discovering Transit Gateway Attachments...")
                 tgw_attachments = self._discover_transit_gateway_attachments(ec2, vpc_ids)
-                
+
                 # Discover VPC Peering Connections
                 status.update("🔄 Discovering VPC Peering Connections...")
                 vpc_peering = self._discover_vpc_peering_connections(ec2, vpc_ids)
-                
+
                 # Discover Security Groups
                 status.update("🛡️ Discovering Security Groups...")
                 security_groups = self._discover_security_groups(ec2, vpc_ids)
-                
+
                 # Create discovery result
                 result = VPCDiscoveryResult(
                     vpcs=vpcs,
@@ -586,79 +599,83 @@ class VPCAnalyzer:
                     transit_gateway_attachments=tgw_attachments,
                     vpc_peering_connections=vpc_peering,
                     security_groups=security_groups,
-                    total_resources=len(vpcs) + len(nat_gateways) + len(vpc_endpoints) +
-                                  len(internet_gateways) + len(route_tables) + len(subnets) +
-                                  len(network_interfaces) + len(tgw_attachments) + 
-                                  len(vpc_peering) + len(security_groups),
-                    discovery_timestamp=datetime.now().isoformat()
+                    total_resources=len(vpcs)
+                    + len(nat_gateways)
+                    + len(vpc_endpoints)
+                    + len(internet_gateways)
+                    + len(route_tables)
+                    + len(subnets)
+                    + len(network_interfaces)
+                    + len(tgw_attachments)
+                    + len(vpc_peering)
+                    + len(security_groups),
+                    discovery_timestamp=datetime.now().isoformat(),
                 )
-                
+
                 self.last_discovery = result
                 self._display_discovery_results(result)
-                
+
                 return result
-                
+
             except Exception as e:
                 print_error(f"VPC discovery failed: {e}")
                 logger.error(f"VPC discovery error: {e}")
                 return self._empty_discovery_result()
 
     async def discover_multi_org_vpc_topology(
-        self,
-        target_accounts: int = 60,
-        landing_zone_structure: Optional[Dict] = None
+        self, target_accounts: int = 60, landing_zone_structure: Optional[Dict] = None
     ) -> VPCDiscoveryResult:
         """
         NEW: Multi-Organization Landing Zone VPC discovery for 60-account operations
-        
+
         Optimized discovery across Landing Zone with decommissioned account filtering
         and enhanced session management.
-        
+
         Args:
             target_accounts: Target number of accounts to discover (60 for Landing Zone)
             landing_zone_structure: Optional Landing Zone organizational structure
-            
+
         Returns:
             VPCDiscoveryResult with comprehensive multi-account topology
         """
         if not self.enable_multi_account or not self.cross_account_manager:
             print_error("Multi-account mode not enabled. Initialize with enable_multi_account=True")
             return self._empty_discovery_result()
-        
+
         print_header("Multi-Organization Landing Zone VPC Discovery", f"Target: {target_accounts} accounts")
-        
+
         start_time = time.time()
-        
+
         try:
             # Step 1: Discover and filter Landing Zone accounts
             print_info("🏢 Discovering Landing Zone organization accounts...")
             accounts = await self._discover_landing_zone_accounts()
-            
+
             # Step 2: Filter decommissioned accounts
             filtered_accounts = self._filter_landing_zone_accounts(accounts)
-            
+
             # Step 3: Create cross-account sessions
             print_info(f"🔐 Creating cross-account sessions for {len(filtered_accounts)} accounts...")
             sessions = await self.cross_account_manager.create_cross_account_sessions_from_accounts(filtered_accounts)
             successful_sessions = self.cross_account_manager.get_successful_sessions(sessions)
-            
+
             self.landing_zone_sessions = successful_sessions
-            
+
             # Step 4: Parallel VPC discovery across all accounts
             print_info(f"🔍 Discovering VPC topology across {len(successful_sessions)} accounts...")
             multi_account_results = await self._discover_vpc_topology_parallel(successful_sessions)
-            
+
             # Step 5: Aggregate results and generate Landing Zone metrics
             aggregated_result = self._aggregate_multi_account_results(multi_account_results, successful_sessions)
-            
+
             # Performance metrics
             execution_time = time.time() - start_time
             print_success(f"✅ Multi-Organization Landing Zone discovery complete in {execution_time:.1f}s")
             print_info(f"   📈 {len(successful_sessions)}/{len(accounts)} accounts discovered")
             print_info(f"   🏗️ {aggregated_result.total_resources} total VPC resources discovered")
-            
+
             return aggregated_result
-            
+
         except Exception as e:
             print_error(f"Multi-Organization Landing Zone discovery failed: {e}")
             logger.error(f"Landing Zone discovery error: {e}")
@@ -668,55 +685,51 @@ class VPCAnalyzer:
         """Discover accounts from Organizations API with Landing Zone context"""
         orgs_client = get_unified_organizations_client(self.profile)
         accounts = await orgs_client.get_organization_accounts()
-        
+
         if not accounts:
             print_warning("No accounts discovered from Organizations API")
             return []
-        
+
         print_info(f"🏢 Discovered {len(accounts)} total organization accounts")
         return accounts
 
     def _filter_landing_zone_accounts(self, accounts: List[OrganizationAccount]) -> List[OrganizationAccount]:
         """
         Filter Landing Zone accounts with decommissioned account exclusion
-        
+
         Applies enterprise-grade filtering:
         - Excludes decommissioned accounts (294618320542 by default)
         - Filters to ACTIVE status accounts only
         - Maintains Landing Zone organizational structure
         """
         # Filter to active accounts only
-        active_accounts = [acc for acc in accounts if acc.status == 'ACTIVE']
-        
+        active_accounts = [acc for acc in accounts if acc.status == "ACTIVE"]
+
         # Filter out decommissioned accounts
-        filtered_accounts = [
-            acc for acc in active_accounts 
-            if acc.account_id not in self.excluded_accounts
-        ]
-        
+        filtered_accounts = [acc for acc in active_accounts if acc.account_id not in self.excluded_accounts]
+
         excluded_count = len(active_accounts) - len(filtered_accounts)
-        
+
         print_info(f"🎯 Landing Zone account filtering:")
         print_info(f"   • Total accounts: {len(accounts)}")
         print_info(f"   • Active accounts: {len(active_accounts)}")
         print_info(f"   • Excluded decommissioned: {excluded_count} ({self.excluded_accounts})")
         print_info(f"   • Ready for discovery: {len(filtered_accounts)}")
-        
+
         return filtered_accounts
 
     async def _discover_vpc_topology_parallel(
-        self, 
-        sessions: List[CrossAccountSession]
+        self, sessions: List[CrossAccountSession]
     ) -> List[Tuple[str, VPCDiscoveryResult]]:
         """
         Parallel VPC discovery across multiple accounts optimized for 60-account Landing Zone
-        
+
         Performance optimized for <60s discovery across entire Landing Zone
         """
         results = []
-        
+
         print_info(f"🚀 Starting parallel VPC discovery across {len(sessions)} accounts")
-        
+
         # Use asyncio.gather for concurrent execution
         async def discover_account_vpc(session: CrossAccountSession) -> Tuple[str, VPCDiscoveryResult]:
             try:
@@ -725,51 +738,51 @@ class VPCAnalyzer:
                     profile=None,  # Use session directly
                     region=self.region,
                     console=self.console,
-                    dry_run=self.dry_run
+                    dry_run=self.dry_run,
                 )
                 account_analyzer.session = session.session
-                
+
                 # Perform single-account VPC discovery
                 discovery_result = account_analyzer.discover_vpc_topology()
-                
+
                 # Add account metadata to results
                 discovery_result.account_summary = {
-                    'account_id': session.account_id,
-                    'account_name': session.account_name,
-                    'role_used': session.role_used,
-                    'discovery_timestamp': discovery_result.discovery_timestamp
+                    "account_id": session.account_id,
+                    "account_name": session.account_name,
+                    "role_used": session.role_used,
+                    "discovery_timestamp": discovery_result.discovery_timestamp,
                 }
-                
+
                 return session.account_id, discovery_result
-                
+
             except Exception as e:
                 print_warning(f"⚠️ VPC discovery failed for account {session.account_id}: {e}")
                 logger.warning(f"Account {session.account_id} VPC discovery error: {e}")
-                
+
                 # Return empty result for failed account
                 empty_result = self._empty_discovery_result()
                 empty_result.account_summary = {
-                    'account_id': session.account_id,
-                    'account_name': session.account_name,
-                    'error': str(e)
+                    "account_id": session.account_id,
+                    "account_name": session.account_name,
+                    "error": str(e),
                 }
                 return session.account_id, empty_result
-        
+
         # Execute parallel discovery
         with create_progress_bar() as progress:
             task = progress.add_task("Discovering VPC topology across accounts...", total=len(sessions))
-            
+
             # Process accounts in batches to manage resource usage
             batch_size = min(self.max_workers, len(sessions))
-            
+
             for i in range(0, len(sessions), batch_size):
-                batch_sessions = sessions[i:i + batch_size]
-                
+                batch_sessions = sessions[i : i + batch_size]
+
                 # Execute batch concurrently
-                batch_results = await asyncio.gather(*[
-                    discover_account_vpc(session) for session in batch_sessions
-                ], return_exceptions=True)
-                
+                batch_results = await asyncio.gather(
+                    *[discover_account_vpc(session) for session in batch_sessions], return_exceptions=True
+                )
+
                 # Process batch results
                 for result in batch_results:
                     if isinstance(result, Exception):
@@ -777,22 +790,20 @@ class VPCAnalyzer:
                     else:
                         results.append(result)
                     progress.advance(task)
-        
+
         print_success(f"✅ Parallel VPC discovery complete: {len(results)} accounts processed")
         return results
 
     def _aggregate_multi_account_results(
-        self, 
-        multi_account_results: List[Tuple[str, VPCDiscoveryResult]],
-        sessions: List[CrossAccountSession]
+        self, multi_account_results: List[Tuple[str, VPCDiscoveryResult]], sessions: List[CrossAccountSession]
     ) -> VPCDiscoveryResult:
         """
         Aggregate multi-account VPC discovery results into comprehensive Landing Zone view
-        
+
         Creates unified view with Landing Zone metrics and account-level aggregation
         """
         print_info("📊 Aggregating multi-account VPC results...")
-        
+
         # Initialize aggregation containers
         all_vpcs = []
         all_nat_gateways = []
@@ -804,73 +815,79 @@ class VPCAnalyzer:
         all_tgw_attachments = []
         all_vpc_peering = []
         all_security_groups = []
-        
+
         account_summaries = []
         total_resources_per_account = {}
-        
+
         # Aggregate resources from all accounts
         for account_id, discovery_result in multi_account_results:
             # Add account context to all resources
             for vpc in discovery_result.vpcs:
-                vpc['AccountId'] = account_id
+                vpc["AccountId"] = account_id
                 all_vpcs.append(vpc)
-            
+
             for nat in discovery_result.nat_gateways:
-                nat['AccountId'] = account_id
+                nat["AccountId"] = account_id
                 all_nat_gateways.append(nat)
-            
+
             for endpoint in discovery_result.vpc_endpoints:
-                endpoint['AccountId'] = account_id
+                endpoint["AccountId"] = account_id
                 all_vpc_endpoints.append(endpoint)
-            
+
             for igw in discovery_result.internet_gateways:
-                igw['AccountId'] = account_id
+                igw["AccountId"] = account_id
                 all_internet_gateways.append(igw)
-            
+
             for rt in discovery_result.route_tables:
-                rt['AccountId'] = account_id
+                rt["AccountId"] = account_id
                 all_route_tables.append(rt)
-            
+
             for subnet in discovery_result.subnets:
-                subnet['AccountId'] = account_id
+                subnet["AccountId"] = account_id
                 all_subnets.append(subnet)
-            
+
             for eni in discovery_result.network_interfaces:
-                eni['AccountId'] = account_id
+                eni["AccountId"] = account_id
                 all_network_interfaces.append(eni)
-            
+
             for tgw in discovery_result.transit_gateway_attachments:
-                tgw['AccountId'] = account_id
+                tgw["AccountId"] = account_id
                 all_tgw_attachments.append(tgw)
-            
+
             for peering in discovery_result.vpc_peering_connections:
-                peering['AccountId'] = account_id
+                peering["AccountId"] = account_id
                 all_vpc_peering.append(peering)
-            
+
             for sg in discovery_result.security_groups:
-                sg['AccountId'] = account_id
+                sg["AccountId"] = account_id
                 all_security_groups.append(sg)
-            
+
             # Track per-account metrics
             total_resources_per_account[account_id] = discovery_result.total_resources
-            
+
             # Collect account summary
             if discovery_result.account_summary:
                 account_summaries.append(discovery_result.account_summary)
-        
+
         # Calculate Landing Zone metrics
         landing_zone_metrics = self._calculate_landing_zone_metrics(
             total_resources_per_account, account_summaries, sessions
         )
-        
+
         # Create aggregated result
         total_resources = (
-            len(all_vpcs) + len(all_nat_gateways) + len(all_vpc_endpoints) +
-            len(all_internet_gateways) + len(all_route_tables) + len(all_subnets) +
-            len(all_network_interfaces) + len(all_tgw_attachments) + 
-            len(all_vpc_peering) + len(all_security_groups)
+            len(all_vpcs)
+            + len(all_nat_gateways)
+            + len(all_vpc_endpoints)
+            + len(all_internet_gateways)
+            + len(all_route_tables)
+            + len(all_subnets)
+            + len(all_network_interfaces)
+            + len(all_tgw_attachments)
+            + len(all_vpc_peering)
+            + len(all_security_groups)
         )
-        
+
         aggregated_result = VPCDiscoveryResult(
             vpcs=all_vpcs,
             nat_gateways=all_nat_gateways,
@@ -884,52 +901,47 @@ class VPCAnalyzer:
             security_groups=all_security_groups,
             total_resources=total_resources,
             discovery_timestamp=datetime.now().isoformat(),
-            account_summary={'accounts_discovered': account_summaries},
-            landing_zone_metrics=landing_zone_metrics
+            account_summary={"accounts_discovered": account_summaries},
+            landing_zone_metrics=landing_zone_metrics,
         )
-        
+
         # Display Landing Zone summary
         self._display_landing_zone_summary(aggregated_result)
-        
+
         return aggregated_result
 
     def _calculate_landing_zone_metrics(
-        self,
-        resources_per_account: Dict[str, int],
-        account_summaries: List[Dict],
-        sessions: List[CrossAccountSession]
+        self, resources_per_account: Dict[str, int], account_summaries: List[Dict], sessions: List[CrossAccountSession]
     ) -> Dict[str, Any]:
         """Calculate comprehensive Landing Zone analytics"""
-        
-        successful_accounts = len([s for s in sessions if s.status in ['success', 'cached']])
-        
+
+        successful_accounts = len([s for s in sessions if s.status in ["success", "cached"]])
+
         return {
-            'total_accounts_targeted': len(sessions),
-            'successful_discoveries': successful_accounts,
-            'failed_discoveries': len(sessions) - successful_accounts,
-            'discovery_success_rate': (successful_accounts / len(sessions) * 100) if sessions else 0,
-            'total_vpc_resources': sum(resources_per_account.values()),
-            'average_resources_per_account': (
-                sum(resources_per_account.values()) / len(resources_per_account)
-                if resources_per_account else 0
+            "total_accounts_targeted": len(sessions),
+            "successful_discoveries": successful_accounts,
+            "failed_discoveries": len(sessions) - successful_accounts,
+            "discovery_success_rate": (successful_accounts / len(sessions) * 100) if sessions else 0,
+            "total_vpc_resources": sum(resources_per_account.values()),
+            "average_resources_per_account": (
+                sum(resources_per_account.values()) / len(resources_per_account) if resources_per_account else 0
             ),
-            'accounts_with_resources': len([count for count in resources_per_account.values() if count > 0]),
-            'empty_accounts': len([count for count in resources_per_account.values() if count == 0]),
-            'decommissioned_accounts_excluded': len(self.excluded_accounts),
-            'excluded_account_list': self.excluded_accounts,
-            'session_manager_metrics': (
-                self.cross_account_manager.get_session_summary(sessions) 
-                if self.cross_account_manager else {}
+            "accounts_with_resources": len([count for count in resources_per_account.values() if count > 0]),
+            "empty_accounts": len([count for count in resources_per_account.values() if count == 0]),
+            "decommissioned_accounts_excluded": len(self.excluded_accounts),
+            "excluded_account_list": self.excluded_accounts,
+            "session_manager_metrics": (
+                self.cross_account_manager.get_session_summary(sessions) if self.cross_account_manager else {}
             ),
-            'generated_at': datetime.now().isoformat()
+            "generated_at": datetime.now().isoformat(),
         }
 
     def _display_landing_zone_summary(self, result: VPCDiscoveryResult):
         """Display comprehensive Landing Zone summary with Rich formatting"""
-        
+
         # Landing Zone overview panel
         metrics = result.landing_zone_metrics
-        
+
         summary_panel = Panel(
             f"[bold green]Multi-Organization Landing Zone Discovery Complete[/bold green]\n\n"
             f"🏢 Accounts Discovered: [bold cyan]{metrics['successful_discoveries']}/{metrics['total_accounts_targeted']}[/bold cyan] "
@@ -949,46 +961,44 @@ class VPCAnalyzer:
             f"TGW Attachments: [bold orange]{len(result.transit_gateway_attachments)}[/bold orange] | "
             f"Security Groups: [bold gray]{len(result.security_groups)}[/bold gray]",
             title="🌐 Landing Zone VPC Discovery Summary",
-            style="bold blue"
+            style="bold blue",
         )
-        
+
         self.console.print(summary_panel)
-        
+
         # Account distribution table
-        if metrics.get('session_manager_metrics'):
-            session_metrics = metrics['session_manager_metrics']
-            
+        if metrics.get("session_manager_metrics"):
+            session_metrics = metrics["session_manager_metrics"]
+
             session_table = create_table(
                 title="🔐 Cross-Account Session Summary",
                 columns=[
                     {"header": "Metric", "style": "cyan"},
                     {"header": "Value", "style": "green"},
-                    {"header": "Details", "style": "dim"}
-                ]
+                    {"header": "Details", "style": "dim"},
+                ],
             )
-            
+
             session_table.add_row(
                 "Session Success Rate",
                 f"{(session_metrics['successful_sessions'] / session_metrics['total_sessions'] * 100):.1f}%",
-                f"{session_metrics['successful_sessions']}/{session_metrics['total_sessions']}"
+                f"{session_metrics['successful_sessions']}/{session_metrics['total_sessions']}",
             )
             session_table.add_row(
                 "Cache Performance",
                 f"{(session_metrics['metrics']['cache_hits'] / max(session_metrics['metrics']['cache_hits'] + session_metrics['metrics']['cache_misses'], 1) * 100):.1f}%",
-                f"{session_metrics['metrics']['cache_hits']} hits, {session_metrics['metrics']['cache_misses']} misses"
+                f"{session_metrics['metrics']['cache_hits']} hits, {session_metrics['metrics']['cache_misses']} misses",
             )
             session_table.add_row(
-                "Session TTL",
-                f"{session_metrics['session_ttl_minutes']} minutes",
-                "4-hour enterprise standard"
+                "Session TTL", f"{session_metrics['session_ttl_minutes']} minutes", "4-hour enterprise standard"
             )
-            
+
             self.console.print(session_table)
 
     def analyze_awso_dependencies(self, discovery_result: Optional[VPCDiscoveryResult] = None) -> AWSOAnalysis:
         """
         AWSO-05 specific dependency analysis for safe VPC cleanup
-        
+
         Implements 12-step dependency analysis:
         1. ENI gate validation (critical blocking check)
         2. NAT Gateway dependency mapping
@@ -1002,71 +1012,74 @@ class VPCAnalyzer:
         10. Default VPC identification
         11. Cross-account dependency check
         12. Evidence bundle generation
-        
+
         Args:
             discovery_result: Previous discovery result (uses last if None)
-            
+
         Returns:
             AWSOAnalysis with comprehensive dependency mapping
         """
         print_header("AWSO-05 Dependency Analysis", "12-Step Validation")
-        
+
         if discovery_result is None:
             discovery_result = self.last_discovery
-            
+
         if not discovery_result:
             print_warning("No discovery data available. Run discover_vpc_topology() first.")
             return self._empty_awso_analysis()
-        
+
         with self.console.status("[bold yellow]Analyzing AWSO-05 dependencies...") as status:
             try:
                 # Step 1: ENI gate validation (CRITICAL)
                 status.update("🚨 Step 1/12: ENI Gate Validation...")
                 eni_warnings = self._analyze_eni_gate_validation(discovery_result)
-                
+
                 # Step 2-4: Network resource dependencies
                 status.update("🔗 Steps 2-4: Network Dependencies...")
                 network_deps = self._analyze_network_dependencies(discovery_result)
-                
+
                 # Step 5-7: Gateway and endpoint dependencies
                 status.update("🌐 Steps 5-7: Gateway Dependencies...")
                 gateway_deps = self._analyze_gateway_dependencies(discovery_result)
-                
+
                 # Step 8-10: Security and route dependencies
                 status.update("🛡️ Steps 8-10: Security Dependencies...")
                 security_deps = self._analyze_security_dependencies(discovery_result)
-                
+
                 # Step 11: Cross-account dependency check
                 status.update("🔄 Step 11: Cross-Account Dependencies...")
                 cross_account_deps = self._analyze_cross_account_dependencies(discovery_result)
-                
+
                 # Step 12: Default VPC identification
                 status.update("🎯 Step 12: Default VPC Analysis...")
                 default_vpcs = self._identify_default_vpcs(discovery_result)
-                
+
                 # Generate cleanup recommendations
                 cleanup_recommendations = self._generate_cleanup_recommendations(
                     discovery_result, eni_warnings, default_vpcs
                 )
-                
+
                 # Create evidence bundle
-                evidence_bundle = self._create_evidence_bundle(discovery_result, {
-                    'eni_warnings': eni_warnings,
-                    'network_deps': network_deps,
-                    'gateway_deps': gateway_deps,
-                    'security_deps': security_deps,
-                    'cross_account_deps': cross_account_deps,
-                    'default_vpcs': default_vpcs
-                })
-                
+                evidence_bundle = self._create_evidence_bundle(
+                    discovery_result,
+                    {
+                        "eni_warnings": eni_warnings,
+                        "network_deps": network_deps,
+                        "gateway_deps": gateway_deps,
+                        "security_deps": security_deps,
+                        "cross_account_deps": cross_account_deps,
+                        "default_vpcs": default_vpcs,
+                    },
+                )
+
                 # Compile dependency chain
                 dependency_chain = {
-                    'network_resources': network_deps,
-                    'gateway_resources': gateway_deps,
-                    'security_resources': security_deps,
-                    'cross_account_resources': cross_account_deps
+                    "network_resources": network_deps,
+                    "gateway_resources": gateway_deps,
+                    "security_resources": security_deps,
+                    "cross_account_resources": cross_account_deps,
                 }
-                
+
                 # Create AWSO analysis result
                 awso_analysis = AWSOAnalysis(
                     default_vpcs=default_vpcs,
@@ -1074,14 +1087,14 @@ class VPCAnalyzer:
                     dependency_chain=dependency_chain,
                     eni_gate_warnings=eni_warnings,
                     cleanup_recommendations=cleanup_recommendations,
-                    evidence_bundle=evidence_bundle
+                    evidence_bundle=evidence_bundle,
                 )
-                
+
                 self.last_awso_analysis = awso_analysis
                 self._display_awso_analysis(awso_analysis)
-                
+
                 return awso_analysis
-                
+
             except Exception as e:
                 print_error(f"AWSO-05 analysis failed: {e}")
                 logger.error(f"AWSO-05 analysis error: {e}")
@@ -1090,73 +1103,73 @@ class VPCAnalyzer:
     def generate_cleanup_evidence(self, output_dir: str = "./awso_evidence") -> Dict[str, str]:
         """
         Generate comprehensive evidence bundle for AWSO-05 cleanup
-        
+
         Creates SHA256-verified evidence bundle with:
         - Complete resource inventory (JSON)
-        - Dependency analysis (JSON) 
+        - Dependency analysis (JSON)
         - ENI gate validation results (JSON)
         - Cleanup recommendations (JSON)
         - Executive summary (Markdown)
         - Evidence manifest with checksums
-        
+
         Args:
             output_dir: Directory to store evidence files
-            
+
         Returns:
             Dict with generated file paths and checksums
         """
         print_header("Evidence Bundle Generation", "AWSO-05 Compliance")
-        
+
         output_path = Path(output_dir)
         output_path.mkdir(parents=True, exist_ok=True)
-        
+
         timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
         evidence_files = {}
-        
+
         try:
             # Generate discovery evidence
             if self.last_discovery:
                 discovery_file = output_path / f"vpc_discovery_{timestamp}.json"
                 self._write_json_evidence(self.last_discovery.__dict__, discovery_file)
-                evidence_files['discovery'] = str(discovery_file)
-            
-            # Generate AWSO analysis evidence  
+                evidence_files["discovery"] = str(discovery_file)
+
+            # Generate AWSO analysis evidence
             if self.last_awso_analysis:
                 awso_file = output_path / f"awso_analysis_{timestamp}.json"
                 self._write_json_evidence(self.last_awso_analysis.__dict__, awso_file)
-                evidence_files['awso_analysis'] = str(awso_file)
-                
+                evidence_files["awso_analysis"] = str(awso_file)
+
                 # Generate executive summary
                 summary_file = output_path / f"executive_summary_{timestamp}.md"
                 self._write_executive_summary(self.last_awso_analysis, summary_file)
-                evidence_files['executive_summary'] = str(summary_file)
-            
+                evidence_files["executive_summary"] = str(summary_file)
+
             # Generate evidence manifest with checksums
             manifest_file = output_path / f"evidence_manifest_{timestamp}.json"
             manifest = self._create_evidence_manifest(evidence_files)
             self._write_json_evidence(manifest, manifest_file)
-            evidence_files['manifest'] = str(manifest_file)
-            
+            evidence_files["manifest"] = str(manifest_file)
+
             print_success(f"Evidence bundle generated: {len(evidence_files)} files")
-            
+
             # Display evidence summary
             table = create_table(
                 title="AWSO-05 Evidence Bundle",
                 columns=[
                     {"header": "Evidence Type", "style": "cyan"},
                     {"header": "File Path", "style": "green"},
-                    {"header": "SHA256", "style": "dim"}
-                ]
+                    {"header": "SHA256", "style": "dim"},
+                ],
             )
-            
+
             for evidence_type, file_path in evidence_files.items():
-                sha256 = manifest.get('file_checksums', {}).get(evidence_type, 'N/A')
+                sha256 = manifest.get("file_checksums", {}).get(evidence_type, "N/A")
                 table.add_row(evidence_type, file_path, sha256[:16] + "...")
-            
+
             self.console.print(table)
-            
+
             return evidence_files
-            
+
         except Exception as e:
             print_error(f"Evidence generation failed: {e}")
             logger.error(f"Evidence generation error: {e}")
@@ -1168,27 +1181,27 @@ class VPCAnalyzer:
         try:
             filters = []
             if vpc_ids:
-                filters.append({'Name': 'vpc-id', 'Values': vpc_ids})
-                
+                filters.append({"Name": "vpc-id", "Values": vpc_ids})
+
             response = ec2_client.describe_vpcs(Filters=filters)
             vpcs = []
-            
-            for vpc in response.get('Vpcs', []):
+
+            for vpc in response.get("Vpcs", []):
                 vpc_info = {
-                    'VpcId': vpc['VpcId'],
-                    'CidrBlock': vpc['CidrBlock'],
-                    'State': vpc['State'],
-                    'IsDefault': vpc['IsDefault'],
-                    'InstanceTenancy': vpc['InstanceTenancy'],
-                    'DhcpOptionsId': vpc['DhcpOptionsId'],
-                    'Tags': {tag['Key']: tag['Value'] for tag in vpc.get('Tags', [])},
-                    'Name': self._get_name_tag(vpc.get('Tags', [])),
-                    'DiscoveredAt': datetime.now().isoformat()
+                    "VpcId": vpc["VpcId"],
+                    "CidrBlock": vpc["CidrBlock"],
+                    "State": vpc["State"],
+                    "IsDefault": vpc["IsDefault"],
+                    "InstanceTenancy": vpc["InstanceTenancy"],
+                    "DhcpOptionsId": vpc["DhcpOptionsId"],
+                    "Tags": {tag["Key"]: tag["Value"] for tag in vpc.get("Tags", [])},
+                    "Name": self._get_name_tag(vpc.get("Tags", [])),
+                    "DiscoveredAt": datetime.now().isoformat(),
                 }
                 vpcs.append(vpc_info)
-                
+
             return vpcs
-            
+
         except Exception as e:
             logger.error(f"Failed to discover VPCs: {e}")
             return []
@@ -1198,28 +1211,28 @@ class VPCAnalyzer:
         try:
             response = ec2_client.describe_nat_gateways()
             nat_gateways = []
-            
-            for nat in response.get('NatGateways', []):
+
+            for nat in response.get("NatGateways", []):
                 # Filter by VPC if specified
-                if vpc_ids and nat.get('VpcId') not in vpc_ids:
+                if vpc_ids and nat.get("VpcId") not in vpc_ids:
                     continue
-                    
+
                 nat_info = {
-                    'NatGatewayId': nat['NatGatewayId'],
-                    'VpcId': nat.get('VpcId'),
-                    'SubnetId': nat.get('SubnetId'),
-                    'State': nat['State'],
-                    'CreateTime': nat.get('CreateTime', '').isoformat() if nat.get('CreateTime') else None,
-                    'ConnectivityType': nat.get('ConnectivityType', 'public'),
-                    'Tags': {tag['Key']: tag['Value'] for tag in nat.get('Tags', [])},
-                    'Name': self._get_name_tag(nat.get('Tags', [])),
-                    'EstimatedMonthlyCost': 45.0,  # Base NAT Gateway cost
-                    'DiscoveredAt': datetime.now().isoformat()
+                    "NatGatewayId": nat["NatGatewayId"],
+                    "VpcId": nat.get("VpcId"),
+                    "SubnetId": nat.get("SubnetId"),
+                    "State": nat["State"],
+                    "CreateTime": nat.get("CreateTime", "").isoformat() if nat.get("CreateTime") else None,
+                    "ConnectivityType": nat.get("ConnectivityType", "public"),
+                    "Tags": {tag["Key"]: tag["Value"] for tag in nat.get("Tags", [])},
+                    "Name": self._get_name_tag(nat.get("Tags", [])),
+                    "EstimatedMonthlyCost": 45.0,  # Base NAT Gateway cost
+                    "DiscoveredAt": datetime.now().isoformat(),
                 }
                 nat_gateways.append(nat_info)
-                
+
             return nat_gateways
-            
+
         except Exception as e:
             logger.error(f"Failed to discover NAT Gateways: {e}")
             return []
@@ -1229,36 +1242,36 @@ class VPCAnalyzer:
         try:
             response = ec2_client.describe_vpc_endpoints()
             endpoints = []
-            
-            for endpoint in response.get('VpcEndpoints', []):
+
+            for endpoint in response.get("VpcEndpoints", []):
                 # Filter by VPC if specified
-                if vpc_ids and endpoint.get('VpcId') not in vpc_ids:
+                if vpc_ids and endpoint.get("VpcId") not in vpc_ids:
                     continue
-                    
+
                 # Calculate costs
                 monthly_cost = 0
-                if endpoint.get('VpcEndpointType') == 'Interface':
-                    az_count = len(endpoint.get('SubnetIds', []))
+                if endpoint.get("VpcEndpointType") == "Interface":
+                    az_count = len(endpoint.get("SubnetIds", []))
                     monthly_cost = 10.0 * az_count  # $10/month per AZ
-                    
+
                 endpoint_info = {
-                    'VpcEndpointId': endpoint['VpcEndpointId'],
-                    'VpcId': endpoint.get('VpcId'),
-                    'ServiceName': endpoint.get('ServiceName'),
-                    'VpcEndpointType': endpoint.get('VpcEndpointType', 'Gateway'),
-                    'State': endpoint.get('State'),
-                    'SubnetIds': endpoint.get('SubnetIds', []),
-                    'RouteTableIds': endpoint.get('RouteTableIds', []),
-                    'PolicyDocument': endpoint.get('PolicyDocument'),
-                    'Tags': {tag['Key']: tag['Value'] for tag in endpoint.get('Tags', [])},
-                    'Name': self._get_name_tag(endpoint.get('Tags', [])),
-                    'EstimatedMonthlyCost': monthly_cost,
-                    'DiscoveredAt': datetime.now().isoformat()
+                    "VpcEndpointId": endpoint["VpcEndpointId"],
+                    "VpcId": endpoint.get("VpcId"),
+                    "ServiceName": endpoint.get("ServiceName"),
+                    "VpcEndpointType": endpoint.get("VpcEndpointType", "Gateway"),
+                    "State": endpoint.get("State"),
+                    "SubnetIds": endpoint.get("SubnetIds", []),
+                    "RouteTableIds": endpoint.get("RouteTableIds", []),
+                    "PolicyDocument": endpoint.get("PolicyDocument"),
+                    "Tags": {tag["Key"]: tag["Value"] for tag in endpoint.get("Tags", [])},
+                    "Name": self._get_name_tag(endpoint.get("Tags", [])),
+                    "EstimatedMonthlyCost": monthly_cost,
+                    "DiscoveredAt": datetime.now().isoformat(),
                 }
                 endpoints.append(endpoint_info)
-                
+
             return endpoints
-            
+
         except Exception as e:
             logger.error(f"Failed to discover VPC Endpoints: {e}")
             return []
@@ -1268,25 +1281,25 @@ class VPCAnalyzer:
         try:
             response = ec2_client.describe_internet_gateways()
             igws = []
-            
-            for igw in response.get('InternetGateways', []):
+
+            for igw in response.get("InternetGateways", []):
                 # Filter by attached VPC if specified
-                attached_vpc_ids = [attachment['VpcId'] for attachment in igw.get('Attachments', [])]
+                attached_vpc_ids = [attachment["VpcId"] for attachment in igw.get("Attachments", [])]
                 if vpc_ids and not any(vpc_id in attached_vpc_ids for vpc_id in vpc_ids):
                     continue
-                    
+
                 igw_info = {
-                    'InternetGatewayId': igw['InternetGatewayId'],
-                    'Attachments': igw.get('Attachments', []),
-                    'AttachedVpcIds': attached_vpc_ids,
-                    'Tags': {tag['Key']: tag['Value'] for tag in igw.get('Tags', [])},
-                    'Name': self._get_name_tag(igw.get('Tags', [])),
-                    'DiscoveredAt': datetime.now().isoformat()
+                    "InternetGatewayId": igw["InternetGatewayId"],
+                    "Attachments": igw.get("Attachments", []),
+                    "AttachedVpcIds": attached_vpc_ids,
+                    "Tags": {tag["Key"]: tag["Value"] for tag in igw.get("Tags", [])},
+                    "Name": self._get_name_tag(igw.get("Tags", [])),
+                    "DiscoveredAt": datetime.now().isoformat(),
                 }
                 igws.append(igw_info)
-                
+
             return igws
-            
+
         except Exception as e:
             logger.error(f"Failed to discover Internet Gateways: {e}")
             return []
@@ -1296,27 +1309,29 @@ class VPCAnalyzer:
         try:
             filters = []
             if vpc_ids:
-                filters.append({'Name': 'vpc-id', 'Values': vpc_ids})
-                
+                filters.append({"Name": "vpc-id", "Values": vpc_ids})
+
             response = ec2_client.describe_route_tables(Filters=filters)
             route_tables = []
-            
-            for rt in response.get('RouteTables', []):
+
+            for rt in response.get("RouteTables", []):
                 rt_info = {
-                    'RouteTableId': rt['RouteTableId'],
-                    'VpcId': rt['VpcId'],
-                    'Routes': rt.get('Routes', []),
-                    'Associations': rt.get('Associations', []),
-                    'Tags': {tag['Key']: tag['Value'] for tag in rt.get('Tags', [])},
-                    'Name': self._get_name_tag(rt.get('Tags', [])),
-                    'IsMainRouteTable': any(assoc.get('Main', False) for assoc in rt.get('Associations', [])),
-                    'AssociatedSubnets': [assoc.get('SubnetId') for assoc in rt.get('Associations', []) if assoc.get('SubnetId')],
-                    'DiscoveredAt': datetime.now().isoformat()
+                    "RouteTableId": rt["RouteTableId"],
+                    "VpcId": rt["VpcId"],
+                    "Routes": rt.get("Routes", []),
+                    "Associations": rt.get("Associations", []),
+                    "Tags": {tag["Key"]: tag["Value"] for tag in rt.get("Tags", [])},
+                    "Name": self._get_name_tag(rt.get("Tags", [])),
+                    "IsMainRouteTable": any(assoc.get("Main", False) for assoc in rt.get("Associations", [])),
+                    "AssociatedSubnets": [
+                        assoc.get("SubnetId") for assoc in rt.get("Associations", []) if assoc.get("SubnetId")
+                    ],
+                    "DiscoveredAt": datetime.now().isoformat(),
                 }
                 route_tables.append(rt_info)
-                
+
             return route_tables
-            
+
         except Exception as e:
             logger.error(f"Failed to discover Route Tables: {e}")
             return []
@@ -1326,28 +1341,28 @@ class VPCAnalyzer:
         try:
             filters = []
             if vpc_ids:
-                filters.append({'Name': 'vpc-id', 'Values': vpc_ids})
-                
+                filters.append({"Name": "vpc-id", "Values": vpc_ids})
+
             response = ec2_client.describe_subnets(Filters=filters)
             subnets = []
-            
-            for subnet in response.get('Subnets', []):
+
+            for subnet in response.get("Subnets", []):
                 subnet_info = {
-                    'SubnetId': subnet['SubnetId'],
-                    'VpcId': subnet['VpcId'],
-                    'CidrBlock': subnet['CidrBlock'],
-                    'AvailabilityZone': subnet['AvailabilityZone'],
-                    'State': subnet['State'],
-                    'MapPublicIpOnLaunch': subnet.get('MapPublicIpOnLaunch', False),
-                    'AvailableIpAddressCount': subnet.get('AvailableIpAddressCount', 0),
-                    'Tags': {tag['Key']: tag['Value'] for tag in subnet.get('Tags', [])},
-                    'Name': self._get_name_tag(subnet.get('Tags', [])),
-                    'DiscoveredAt': datetime.now().isoformat()
+                    "SubnetId": subnet["SubnetId"],
+                    "VpcId": subnet["VpcId"],
+                    "CidrBlock": subnet["CidrBlock"],
+                    "AvailabilityZone": subnet["AvailabilityZone"],
+                    "State": subnet["State"],
+                    "MapPublicIpOnLaunch": subnet.get("MapPublicIpOnLaunch", False),
+                    "AvailableIpAddressCount": subnet.get("AvailableIpAddressCount", 0),
+                    "Tags": {tag["Key"]: tag["Value"] for tag in subnet.get("Tags", [])},
+                    "Name": self._get_name_tag(subnet.get("Tags", [])),
+                    "DiscoveredAt": datetime.now().isoformat(),
                 }
                 subnets.append(subnet_info)
-                
+
             return subnets
-            
+
         except Exception as e:
             logger.error(f"Failed to discover Subnets: {e}")
             return []
@@ -1357,33 +1372,33 @@ class VPCAnalyzer:
         try:
             filters = []
             if vpc_ids:
-                filters.append({'Name': 'vpc-id', 'Values': vpc_ids})
-                
+                filters.append({"Name": "vpc-id", "Values": vpc_ids})
+
             response = ec2_client.describe_network_interfaces(Filters=filters)
             network_interfaces = []
-            
-            for eni in response.get('NetworkInterfaces', []):
+
+            for eni in response.get("NetworkInterfaces", []):
                 eni_info = {
-                    'NetworkInterfaceId': eni['NetworkInterfaceId'],
-                    'VpcId': eni.get('VpcId'),
-                    'SubnetId': eni.get('SubnetId'),
-                    'Status': eni.get('Status'),
-                    'InterfaceType': eni.get('InterfaceType', 'interface'),
-                    'Attachment': eni.get('Attachment'),
-                    'Groups': eni.get('Groups', []),
-                    'PrivateIpAddress': eni.get('PrivateIpAddress'),
-                    'PrivateIpAddresses': eni.get('PrivateIpAddresses', []),
-                    'Tags': {tag['Key']: tag['Value'] for tag in eni.get('Tags', [])},
-                    'Name': self._get_name_tag(eni.get('Tags', [])),
-                    'RequesterManaged': eni.get('RequesterManaged', False),
-                    'IsAttached': bool(eni.get('Attachment')),
-                    'AttachedInstanceId': eni.get('Attachment', {}).get('InstanceId'),
-                    'DiscoveredAt': datetime.now().isoformat()
+                    "NetworkInterfaceId": eni["NetworkInterfaceId"],
+                    "VpcId": eni.get("VpcId"),
+                    "SubnetId": eni.get("SubnetId"),
+                    "Status": eni.get("Status"),
+                    "InterfaceType": eni.get("InterfaceType", "interface"),
+                    "Attachment": eni.get("Attachment"),
+                    "Groups": eni.get("Groups", []),
+                    "PrivateIpAddress": eni.get("PrivateIpAddress"),
+                    "PrivateIpAddresses": eni.get("PrivateIpAddresses", []),
+                    "Tags": {tag["Key"]: tag["Value"] for tag in eni.get("Tags", [])},
+                    "Name": self._get_name_tag(eni.get("Tags", [])),
+                    "RequesterManaged": eni.get("RequesterManaged", False),
+                    "IsAttached": bool(eni.get("Attachment")),
+                    "AttachedInstanceId": eni.get("Attachment", {}).get("InstanceId"),
+                    "DiscoveredAt": datetime.now().isoformat(),
                 }
                 network_interfaces.append(eni_info)
-                
+
             return network_interfaces
-            
+
         except Exception as e:
             logger.error(f"Failed to discover Network Interfaces: {e}")
             return []
@@ -1393,27 +1408,27 @@ class VPCAnalyzer:
         try:
             response = ec2_client.describe_transit_gateway_attachments()
             attachments = []
-            
-            for attachment in response.get('TransitGatewayAttachments', []):
+
+            for attachment in response.get("TransitGatewayAttachments", []):
                 # Filter by VPC if specified
-                if vpc_ids and attachment.get('ResourceType') == 'vpc' and attachment.get('ResourceId') not in vpc_ids:
+                if vpc_ids and attachment.get("ResourceType") == "vpc" and attachment.get("ResourceId") not in vpc_ids:
                     continue
-                    
+
                 attachment_info = {
-                    'TransitGatewayAttachmentId': attachment['TransitGatewayAttachmentId'],
-                    'TransitGatewayId': attachment.get('TransitGatewayId'),
-                    'ResourceType': attachment.get('ResourceType'),
-                    'ResourceId': attachment.get('ResourceId'),
-                    'State': attachment.get('State'),
-                    'Tags': {tag['Key']: tag['Value'] for tag in attachment.get('Tags', [])},
-                    'Name': self._get_name_tag(attachment.get('Tags', [])),
-                    'ResourceOwnerId': attachment.get('ResourceOwnerId'),
-                    'DiscoveredAt': datetime.now().isoformat()
+                    "TransitGatewayAttachmentId": attachment["TransitGatewayAttachmentId"],
+                    "TransitGatewayId": attachment.get("TransitGatewayId"),
+                    "ResourceType": attachment.get("ResourceType"),
+                    "ResourceId": attachment.get("ResourceId"),
+                    "State": attachment.get("State"),
+                    "Tags": {tag["Key"]: tag["Value"] for tag in attachment.get("Tags", [])},
+                    "Name": self._get_name_tag(attachment.get("Tags", [])),
+                    "ResourceOwnerId": attachment.get("ResourceOwnerId"),
+                    "DiscoveredAt": datetime.now().isoformat(),
                 }
                 attachments.append(attachment_info)
-                
+
             return attachments
-            
+
         except Exception as e:
             logger.error(f"Failed to discover Transit Gateway Attachments: {e}")
             return []
@@ -1423,29 +1438,29 @@ class VPCAnalyzer:
         try:
             response = ec2_client.describe_vpc_peering_connections()
             connections = []
-            
-            for connection in response.get('VpcPeeringConnections', []):
-                accepter_vpc_id = connection.get('AccepterVpcInfo', {}).get('VpcId')
-                requester_vpc_id = connection.get('RequesterVpcInfo', {}).get('VpcId')
-                
+
+            for connection in response.get("VpcPeeringConnections", []):
+                accepter_vpc_id = connection.get("AccepterVpcInfo", {}).get("VpcId")
+                requester_vpc_id = connection.get("RequesterVpcInfo", {}).get("VpcId")
+
                 # Filter by VPC if specified
                 if vpc_ids and accepter_vpc_id not in vpc_ids and requester_vpc_id not in vpc_ids:
                     continue
-                    
+
                 connection_info = {
-                    'VpcPeeringConnectionId': connection['VpcPeeringConnectionId'],
-                    'AccepterVpcInfo': connection.get('AccepterVpcInfo', {}),
-                    'RequesterVpcInfo': connection.get('RequesterVpcInfo', {}),
-                    'Status': connection.get('Status', {}),
-                    'Tags': {tag['Key']: tag['Value'] for tag in connection.get('Tags', [])},
-                    'Name': self._get_name_tag(connection.get('Tags', [])),
-                    'ExpirationTime': connection.get('ExpirationTime'),
-                    'DiscoveredAt': datetime.now().isoformat()
+                    "VpcPeeringConnectionId": connection["VpcPeeringConnectionId"],
+                    "AccepterVpcInfo": connection.get("AccepterVpcInfo", {}),
+                    "RequesterVpcInfo": connection.get("RequesterVpcInfo", {}),
+                    "Status": connection.get("Status", {}),
+                    "Tags": {tag["Key"]: tag["Value"] for tag in connection.get("Tags", [])},
+                    "Name": self._get_name_tag(connection.get("Tags", [])),
+                    "ExpirationTime": connection.get("ExpirationTime"),
+                    "DiscoveredAt": datetime.now().isoformat(),
                 }
                 connections.append(connection_info)
-                
+
             return connections
-            
+
         except Exception as e:
             logger.error(f"Failed to discover VPC Peering Connections: {e}")
             return []
@@ -1455,28 +1470,28 @@ class VPCAnalyzer:
         try:
             filters = []
             if vpc_ids:
-                filters.append({'Name': 'vpc-id', 'Values': vpc_ids})
-                
+                filters.append({"Name": "vpc-id", "Values": vpc_ids})
+
             response = ec2_client.describe_security_groups(Filters=filters)
             security_groups = []
-            
-            for sg in response.get('SecurityGroups', []):
+
+            for sg in response.get("SecurityGroups", []):
                 sg_info = {
-                    'GroupId': sg['GroupId'],
-                    'GroupName': sg['GroupName'],
-                    'VpcId': sg.get('VpcId'),
-                    'Description': sg.get('Description', ''),
-                    'IpPermissions': sg.get('IpPermissions', []),
-                    'IpPermissionsEgress': sg.get('IpPermissionsEgress', []),
-                    'Tags': {tag['Key']: tag['Value'] for tag in sg.get('Tags', [])},
-                    'Name': self._get_name_tag(sg.get('Tags', [])),
-                    'IsDefault': sg.get('GroupName') == 'default',
-                    'DiscoveredAt': datetime.now().isoformat()
+                    "GroupId": sg["GroupId"],
+                    "GroupName": sg["GroupName"],
+                    "VpcId": sg.get("VpcId"),
+                    "Description": sg.get("Description", ""),
+                    "IpPermissions": sg.get("IpPermissions", []),
+                    "IpPermissionsEgress": sg.get("IpPermissionsEgress", []),
+                    "Tags": {tag["Key"]: tag["Value"] for tag in sg.get("Tags", [])},
+                    "Name": self._get_name_tag(sg.get("Tags", [])),
+                    "IsDefault": sg.get("GroupName") == "default",
+                    "DiscoveredAt": datetime.now().isoformat(),
                 }
                 security_groups.append(sg_info)
-                
+
             return security_groups
-            
+
         except Exception as e:
             logger.error(f"Failed to discover Security Groups: {e}")
             return []
@@ -1485,241 +1500,258 @@ class VPCAnalyzer:
     def _analyze_eni_gate_validation(self, discovery: VPCDiscoveryResult) -> List[Dict[str, Any]]:
         """AWSO-05 Step 1: Critical ENI gate validation to prevent workload disruption"""
         warnings = []
-        
+
         for eni in discovery.network_interfaces:
             # Check for attached ENIs that could indicate active workloads
-            if eni['IsAttached'] and not eni['RequesterManaged']:
-                warnings.append({
-                    'NetworkInterfaceId': eni['NetworkInterfaceId'],
-                    'VpcId': eni['VpcId'],
-                    'AttachedInstanceId': eni.get('AttachedInstanceId'),
-                    'WarningType': 'ATTACHED_ENI',
-                    'RiskLevel': 'HIGH',
-                    'Message': f"ENI {eni['NetworkInterfaceId']} is attached to instance {eni.get('AttachedInstanceId')} - VPC cleanup may disrupt workload",
-                    'Recommendation': 'Verify workload migration before VPC cleanup'
-                })
-        
+            if eni["IsAttached"] and not eni["RequesterManaged"]:
+                warnings.append(
+                    {
+                        "NetworkInterfaceId": eni["NetworkInterfaceId"],
+                        "VpcId": eni["VpcId"],
+                        "AttachedInstanceId": eni.get("AttachedInstanceId"),
+                        "WarningType": "ATTACHED_ENI",
+                        "RiskLevel": "HIGH",
+                        "Message": f"ENI {eni['NetworkInterfaceId']} is attached to instance {eni.get('AttachedInstanceId')} - VPC cleanup may disrupt workload",
+                        "Recommendation": "Verify workload migration before VPC cleanup",
+                    }
+                )
+
         return warnings
 
     def _analyze_network_dependencies(self, discovery: VPCDiscoveryResult) -> Dict[str, List[str]]:
         """AWSO-05 Steps 2-4: Network resource dependency analysis"""
         dependencies = {}
-        
+
         # NAT Gateway dependencies
         for nat in discovery.nat_gateways:
-            vpc_id = nat['VpcId']
+            vpc_id = nat["VpcId"]
             if vpc_id not in dependencies:
                 dependencies[vpc_id] = []
             dependencies[vpc_id].append(f"NAT Gateway: {nat['NatGatewayId']}")
-            
+
         # VPC Endpoint dependencies
         for endpoint in discovery.vpc_endpoints:
-            vpc_id = endpoint['VpcId']
+            vpc_id = endpoint["VpcId"]
             if vpc_id not in dependencies:
                 dependencies[vpc_id] = []
             dependencies[vpc_id].append(f"VPC Endpoint: {endpoint['VpcEndpointId']}")
-            
+
         return dependencies
 
     def _analyze_gateway_dependencies(self, discovery: VPCDiscoveryResult) -> Dict[str, List[str]]:
         """AWSO-05 Steps 5-7: Gateway dependency analysis"""
         dependencies = {}
-        
+
         # Internet Gateway dependencies
         for igw in discovery.internet_gateways:
-            for vpc_id in igw['AttachedVpcIds']:
+            for vpc_id in igw["AttachedVpcIds"]:
                 if vpc_id not in dependencies:
                     dependencies[vpc_id] = []
                 dependencies[vpc_id].append(f"Internet Gateway: {igw['InternetGatewayId']}")
-        
+
         # Transit Gateway Attachment dependencies
         for attachment in discovery.transit_gateway_attachments:
-            if attachment['ResourceType'] == 'vpc':
-                vpc_id = attachment['ResourceId']
+            if attachment["ResourceType"] == "vpc":
+                vpc_id = attachment["ResourceId"]
                 if vpc_id not in dependencies:
                     dependencies[vpc_id] = []
                 dependencies[vpc_id].append(f"Transit Gateway Attachment: {attachment['TransitGatewayAttachmentId']}")
-                
+
         return dependencies
 
     def _analyze_security_dependencies(self, discovery: VPCDiscoveryResult) -> Dict[str, List[str]]:
         """AWSO-05 Steps 8-10: Security and route dependency analysis"""
         dependencies = {}
-        
+
         # Route Table dependencies
         for rt in discovery.route_tables:
-            vpc_id = rt['VpcId']
+            vpc_id = rt["VpcId"]
             if vpc_id not in dependencies:
                 dependencies[vpc_id] = []
-            if not rt['IsMainRouteTable']:  # Don't list main route tables as dependencies
+            if not rt["IsMainRouteTable"]:  # Don't list main route tables as dependencies
                 dependencies[vpc_id].append(f"Route Table: {rt['RouteTableId']}")
-                
+
         # Security Group dependencies (non-default)
         for sg in discovery.security_groups:
-            if not sg['IsDefault']:
-                vpc_id = sg['VpcId']
+            if not sg["IsDefault"]:
+                vpc_id = sg["VpcId"]
                 if vpc_id not in dependencies:
                     dependencies[vpc_id] = []
                 dependencies[vpc_id].append(f"Security Group: {sg['GroupId']}")
-                
+
         return dependencies
 
     def _analyze_cross_account_dependencies(self, discovery: VPCDiscoveryResult) -> Dict[str, List[str]]:
         """AWSO-05 Step 11: Cross-account dependency analysis"""
         dependencies = {}
-        
+
         # VPC Peering cross-account connections
         for connection in discovery.vpc_peering_connections:
-            accepter_vpc = connection['AccepterVpcInfo']
-            requester_vpc = connection['RequesterVpcInfo']
-            
+            accepter_vpc = connection["AccepterVpcInfo"]
+            requester_vpc = connection["RequesterVpcInfo"]
+
             # Check for cross-account peering
-            if accepter_vpc.get('OwnerId') != requester_vpc.get('OwnerId'):
+            if accepter_vpc.get("OwnerId") != requester_vpc.get("OwnerId"):
                 for vpc_info in [accepter_vpc, requester_vpc]:
-                    vpc_id = vpc_info.get('VpcId')
+                    vpc_id = vpc_info.get("VpcId")
                     if vpc_id:
                         if vpc_id not in dependencies:
                             dependencies[vpc_id] = []
-                        dependencies[vpc_id].append(f"Cross-Account VPC Peering: {connection['VpcPeeringConnectionId']}")
-        
+                        dependencies[vpc_id].append(
+                            f"Cross-Account VPC Peering: {connection['VpcPeeringConnectionId']}"
+                        )
+
         return dependencies
 
     def _identify_default_vpcs(self, discovery: VPCDiscoveryResult) -> List[Dict[str, Any]]:
         """AWSO-05 Step 12: Identify default VPCs for CIS Benchmark compliance"""
         default_vpcs = []
-        
+
         for vpc in discovery.vpcs:
-            if vpc['IsDefault']:
+            if vpc["IsDefault"]:
                 # Check for resources in default VPC
                 resources_in_vpc = []
-                
+
                 # Count ENIs (excluding AWS managed)
-                eni_count = len([eni for eni in discovery.network_interfaces 
-                               if eni['VpcId'] == vpc['VpcId'] and not eni['RequesterManaged']])
+                eni_count = len(
+                    [
+                        eni
+                        for eni in discovery.network_interfaces
+                        if eni["VpcId"] == vpc["VpcId"] and not eni["RequesterManaged"]
+                    ]
+                )
                 if eni_count > 0:
                     resources_in_vpc.append(f"{eni_count} Network Interfaces")
-                
+
                 # Count NAT Gateways
-                nat_count = len([nat for nat in discovery.nat_gateways if nat['VpcId'] == vpc['VpcId']])
+                nat_count = len([nat for nat in discovery.nat_gateways if nat["VpcId"] == vpc["VpcId"]])
                 if nat_count > 0:
                     resources_in_vpc.append(f"{nat_count} NAT Gateways")
-                
+
                 # Count VPC Endpoints
-                endpoint_count = len([ep for ep in discovery.vpc_endpoints if ep['VpcId'] == vpc['VpcId']])
+                endpoint_count = len([ep for ep in discovery.vpc_endpoints if ep["VpcId"] == vpc["VpcId"]])
                 if endpoint_count > 0:
                     resources_in_vpc.append(f"{endpoint_count} VPC Endpoints")
-                
+
                 default_vpc_info = {
-                    'VpcId': vpc['VpcId'],
-                    'CidrBlock': vpc['CidrBlock'],
-                    'Region': self.region,
-                    'ResourcesPresent': resources_in_vpc,
-                    'ResourceCount': len(resources_in_vpc),
-                    'CleanupRecommendation': 'DELETE' if len(resources_in_vpc) == 0 else 'MIGRATE_RESOURCES_FIRST',
-                    'CISBenchmarkCompliance': 'NON_COMPLIANT',
-                    'SecurityRisk': 'HIGH' if len(resources_in_vpc) > 0 else 'MEDIUM'
+                    "VpcId": vpc["VpcId"],
+                    "CidrBlock": vpc["CidrBlock"],
+                    "Region": self.region,
+                    "ResourcesPresent": resources_in_vpc,
+                    "ResourceCount": len(resources_in_vpc),
+                    "CleanupRecommendation": "DELETE" if len(resources_in_vpc) == 0 else "MIGRATE_RESOURCES_FIRST",
+                    "CISBenchmarkCompliance": "NON_COMPLIANT",
+                    "SecurityRisk": "HIGH" if len(resources_in_vpc) > 0 else "MEDIUM",
                 }
                 default_vpcs.append(default_vpc_info)
-        
+
         return default_vpcs
 
     def _identify_orphaned_resources(self, discovery: VPCDiscoveryResult) -> List[Dict[str, Any]]:
         """Identify orphaned resources that can be safely cleaned up"""
         orphaned = []
-        
+
         # Orphaned NAT Gateways (no route table references)
         used_nat_gateways = set()
         for rt in discovery.route_tables:
-            for route in rt['Routes']:
-                if route.get('NatGatewayId'):
-                    used_nat_gateways.add(route['NatGatewayId'])
-        
+            for route in rt["Routes"]:
+                if route.get("NatGatewayId"):
+                    used_nat_gateways.add(route["NatGatewayId"])
+
         for nat in discovery.nat_gateways:
-            if nat['NatGatewayId'] not in used_nat_gateways and nat['State'] == 'available':
-                orphaned.append({
-                    'ResourceType': 'NAT Gateway',
-                    'ResourceId': nat['NatGatewayId'],
-                    'VpcId': nat['VpcId'],
-                    'Reason': 'No route table references',
-                    'EstimatedMonthlySavings': nat['EstimatedMonthlyCost']
-                })
-        
+            if nat["NatGatewayId"] not in used_nat_gateways and nat["State"] == "available":
+                orphaned.append(
+                    {
+                        "ResourceType": "NAT Gateway",
+                        "ResourceId": nat["NatGatewayId"],
+                        "VpcId": nat["VpcId"],
+                        "Reason": "No route table references",
+                        "EstimatedMonthlySavings": nat["EstimatedMonthlyCost"],
+                    }
+                )
+
         return orphaned
 
-    def _generate_cleanup_recommendations(self, discovery: VPCDiscoveryResult, 
-                                        eni_warnings: List[Dict], 
-                                        default_vpcs: List[Dict]) -> List[Dict[str, Any]]:
+    def _generate_cleanup_recommendations(
+        self, discovery: VPCDiscoveryResult, eni_warnings: List[Dict], default_vpcs: List[Dict]
+    ) -> List[Dict[str, Any]]:
         """Generate AWSO-05 cleanup recommendations"""
         recommendations = []
-        
+
         # Default VPC cleanup recommendations
         for default_vpc in default_vpcs:
-            if default_vpc['CleanupRecommendation'] == 'DELETE':
-                recommendations.append({
-                    'Priority': 'HIGH',
-                    'Action': 'DELETE_DEFAULT_VPC',
-                    'ResourceType': 'VPC',
-                    'ResourceId': default_vpc['VpcId'],
-                    'Reason': 'Empty default VPC - CIS Benchmark compliance',
-                    'EstimatedMonthlySavings': 0,
-                    'SecurityBenefit': 'Reduces attack surface',
-                    'RiskLevel': 'LOW'
-                })
+            if default_vpc["CleanupRecommendation"] == "DELETE":
+                recommendations.append(
+                    {
+                        "Priority": "HIGH",
+                        "Action": "DELETE_DEFAULT_VPC",
+                        "ResourceType": "VPC",
+                        "ResourceId": default_vpc["VpcId"],
+                        "Reason": "Empty default VPC - CIS Benchmark compliance",
+                        "EstimatedMonthlySavings": 0,
+                        "SecurityBenefit": "Reduces attack surface",
+                        "RiskLevel": "LOW",
+                    }
+                )
             else:
-                recommendations.append({
-                    'Priority': 'MEDIUM',
-                    'Action': 'MIGRATE_FROM_DEFAULT_VPC',
-                    'ResourceType': 'VPC',
-                    'ResourceId': default_vpc['VpcId'],
-                    'Reason': 'Default VPC with resources - requires migration',
-                    'EstimatedMonthlySavings': 0,
-                    'SecurityBenefit': 'Improves security posture',
-                    'RiskLevel': 'HIGH'
-                })
-        
+                recommendations.append(
+                    {
+                        "Priority": "MEDIUM",
+                        "Action": "MIGRATE_FROM_DEFAULT_VPC",
+                        "ResourceType": "VPC",
+                        "ResourceId": default_vpc["VpcId"],
+                        "Reason": "Default VPC with resources - requires migration",
+                        "EstimatedMonthlySavings": 0,
+                        "SecurityBenefit": "Improves security posture",
+                        "RiskLevel": "HIGH",
+                    }
+                )
+
         # ENI-based recommendations
         if eni_warnings:
-            recommendations.append({
-                'Priority': 'CRITICAL',
-                'Action': 'REVIEW_WORKLOAD_MIGRATION',
-                'ResourceType': 'Multiple',
-                'ResourceId': 'Multiple ENIs',
-                'Reason': f'{len(eni_warnings)} attached ENIs detected - workload migration required',
-                'EstimatedMonthlySavings': 0,
-                'SecurityBenefit': 'Prevents workload disruption',
-                'RiskLevel': 'CRITICAL'
-            })
-        
+            recommendations.append(
+                {
+                    "Priority": "CRITICAL",
+                    "Action": "REVIEW_WORKLOAD_MIGRATION",
+                    "ResourceType": "Multiple",
+                    "ResourceId": "Multiple ENIs",
+                    "Reason": f"{len(eni_warnings)} attached ENIs detected - workload migration required",
+                    "EstimatedMonthlySavings": 0,
+                    "SecurityBenefit": "Prevents workload disruption",
+                    "RiskLevel": "CRITICAL",
+                }
+            )
+
         return recommendations
 
     def _create_evidence_bundle(self, discovery: VPCDiscoveryResult, analysis_data: Dict) -> Dict[str, Any]:
         """Create comprehensive evidence bundle for AWSO-05 compliance"""
         return {
-            'BundleVersion': '1.0',
-            'GeneratedAt': datetime.now().isoformat(),
-            'Profile': self.profile,
-            'Region': self.region,
-            'DiscoverySummary': {
-                'TotalVPCs': len(discovery.vpcs),
-                'DefaultVPCs': len(analysis_data['default_vpcs']),
-                'TotalResources': discovery.total_resources,
-                'ENIWarnings': len(analysis_data['eni_warnings'])
+            "BundleVersion": "1.0",
+            "GeneratedAt": datetime.now().isoformat(),
+            "Profile": self.profile,
+            "Region": self.region,
+            "DiscoverySummary": {
+                "TotalVPCs": len(discovery.vpcs),
+                "DefaultVPCs": len(analysis_data["default_vpcs"]),
+                "TotalResources": discovery.total_resources,
+                "ENIWarnings": len(analysis_data["eni_warnings"]),
             },
-            'ComplianceStatus': {
-                'CISBenchmark': 'NON_COMPLIANT' if analysis_data['default_vpcs'] else 'COMPLIANT',
-                'ENIGateValidation': 'PASSED' if not analysis_data['eni_warnings'] else 'WARNINGS_PRESENT'
+            "ComplianceStatus": {
+                "CISBenchmark": "NON_COMPLIANT" if analysis_data["default_vpcs"] else "COMPLIANT",
+                "ENIGateValidation": "PASSED" if not analysis_data["eni_warnings"] else "WARNINGS_PRESENT",
             },
-            'CleanupReadiness': 'READY' if not analysis_data['eni_warnings'] else 'REQUIRES_WORKLOAD_MIGRATION'
+            "CleanupReadiness": "READY" if not analysis_data["eni_warnings"] else "REQUIRES_WORKLOAD_MIGRATION",
         }
 
     # NEW: Convenience methods for CLI integration
     def discover_landing_zone_vpc_topology(self) -> VPCDiscoveryResult:
         """
         Convenience method for CLI integration - Multi-Organization Landing Zone discovery
-        
+
         Automatically enables multi-account mode and discovers VPC topology across
         60-account Landing Zone with decommissioned account filtering.
-        
+
         Returns:
             VPCDiscoveryResult with comprehensive Landing Zone topology
         """
@@ -1727,12 +1759,10 @@ class VPCAnalyzer:
             # Auto-enable multi-account mode for Landing Zone discovery
             self.enable_multi_account = True
             self.cross_account_manager = EnhancedCrossAccountManager(
-                base_profile=self.profile,
-                max_workers=self.max_workers,
-                session_ttl_minutes=240
+                base_profile=self.profile, max_workers=self.max_workers, session_ttl_minutes=240
             )
             print_info("🌐 Auto-enabled Multi-Organization Landing Zone mode")
-        
+
         # Use asyncio.run for CLI compatibility
         return asyncio.run(self.discover_multi_org_vpc_topology())
 
@@ -1740,7 +1770,7 @@ class VPCAnalyzer:
         """Get comprehensive Landing Zone session summary for reporting"""
         if not self.landing_zone_sessions or not self.cross_account_manager:
             return None
-        
+
         return self.cross_account_manager.get_session_summary(self.landing_zone_sessions)
 
     def refresh_landing_zone_sessions(self) -> bool:
@@ -1748,44 +1778,52 @@ class VPCAnalyzer:
         if not self.landing_zone_sessions or not self.cross_account_manager:
             print_warning("No Landing Zone sessions to refresh")
             return False
-        
+
         print_info("🔄 Refreshing Landing Zone sessions...")
-        self.landing_zone_sessions = self.cross_account_manager.refresh_expired_sessions(
-            self.landing_zone_sessions
-        )
-        
-        successful_sessions = len([s for s in self.landing_zone_sessions if s.status in ['success', 'cached']])
+        self.landing_zone_sessions = self.cross_account_manager.refresh_expired_sessions(self.landing_zone_sessions)
+
+        successful_sessions = len([s for s in self.landing_zone_sessions if s.status in ["success", "cached"]])
         print_success(f"✅ Session refresh complete: {successful_sessions} sessions ready")
-        
+
         return successful_sessions > 0
 
     # Helper methods
     def _empty_discovery_result(self) -> VPCDiscoveryResult:
         """Return empty discovery result with Landing Zone structure"""
         return VPCDiscoveryResult(
-            vpcs=[], nat_gateways=[], vpc_endpoints=[], internet_gateways=[],
-            route_tables=[], subnets=[], network_interfaces=[], 
-            transit_gateway_attachments=[], vpc_peering_connections=[],
-            security_groups=[], total_resources=0,
+            vpcs=[],
+            nat_gateways=[],
+            vpc_endpoints=[],
+            internet_gateways=[],
+            route_tables=[],
+            subnets=[],
+            network_interfaces=[],
+            transit_gateway_attachments=[],
+            vpc_peering_connections=[],
+            security_groups=[],
+            total_resources=0,
             discovery_timestamp=datetime.now().isoformat(),
             account_summary=None,
-            landing_zone_metrics=None
+            landing_zone_metrics=None,
         )
 
     def _empty_awso_analysis(self) -> AWSOAnalysis:
         """Return empty AWSO analysis result"""
         return AWSOAnalysis(
-            default_vpcs=[], orphaned_resources=[], dependency_chain={},
-            eni_gate_warnings=[], cleanup_recommendations=[],
-            evidence_bundle={}
+            default_vpcs=[],
+            orphaned_resources=[],
+            dependency_chain={},
+            eni_gate_warnings=[],
+            cleanup_recommendations=[],
+            evidence_bundle={},
         )
 
     def _get_name_tag(self, tags: List[Dict]) -> str:
         """Extract Name tag from tag list"""
         for tag in tags:
-            if tag['Key'] == 'Name':
-                return tag['Value']
-        return 'Unnamed'
+            if tag["Key"] == "Name":
+                return tag["Value"]
+        return "Unnamed"
 
     def _display_discovery_results(self, result: VPCDiscoveryResult):
         """Display VPC discovery results with Rich formatting"""
@@ -1804,7 +1842,7 @@ class VPCAnalyzer:
             f"Security Groups: [bold gray]{len(result.security_groups)}[/bold gray]\n\n"
             f"[dim]Total Resources: {result.total_resources}[/dim]",
             title="🔍 VPC Discovery Summary",
-            style="bold blue"
+            style="bold blue",
         )
         self.console.print(summary)
 
@@ -1812,39 +1850,39 @@ class VPCAnalyzer:
         """Display AWSO-05 analysis results with Rich formatting"""
         # Create summary tree
         tree = Tree("🎯 AWSO-05 Analysis Results")
-        
+
         # Default VPCs branch
         default_branch = tree.add("🚨 Default VPCs")
         for vpc in analysis.default_vpcs:
-            status = "🔴 Non-Compliant" if vpc['SecurityRisk'] == 'HIGH' else "🟡 Requires Review"
+            status = "🔴 Non-Compliant" if vpc["SecurityRisk"] == "HIGH" else "🟡 Requires Review"
             default_branch.add(f"{vpc['VpcId']} - {status}")
-        
+
         # ENI Warnings branch
         eni_branch = tree.add("⚠️ ENI Gate Warnings")
         for warning in analysis.eni_gate_warnings:
             eni_branch.add(f"{warning['NetworkInterfaceId']} - {warning['Message']}")
-        
+
         # Recommendations branch
         rec_branch = tree.add("💡 Cleanup Recommendations")
         for rec in analysis.cleanup_recommendations:
-            priority_icon = "🔴" if rec['Priority'] == 'CRITICAL' else "🟡" if rec['Priority'] == 'HIGH' else "🟢"
+            priority_icon = "🔴" if rec["Priority"] == "CRITICAL" else "🟡" if rec["Priority"] == "HIGH" else "🟢"
             rec_branch.add(f"{priority_icon} {rec['Action']} - {rec['ResourceId']}")
-        
+
         self.console.print(tree)
-        
+
         # Evidence bundle summary
         bundle_info = Panel(
             f"Bundle Version: [bold]{analysis.evidence_bundle.get('BundleVersion', 'N/A')}[/bold]\n"
             f"Cleanup Readiness: [bold]{analysis.evidence_bundle.get('CleanupReadiness', 'UNKNOWN')}[/bold]\n"
             f"CIS Benchmark: [bold]{analysis.evidence_bundle.get('ComplianceStatus', {}).get('CISBenchmark', 'UNKNOWN')}[/bold]",
             title="📋 Evidence Bundle",
-            style="bold green"
+            style="bold green",
         )
         self.console.print(bundle_info)
 
     def _write_json_evidence(self, data: Dict, file_path: Path):
         """Write JSON evidence file"""
-        with open(file_path, 'w') as f:
+        with open(file_path, "w") as f:
             json.dump(data, f, indent=2, default=str)
 
     def _write_executive_summary(self, analysis: AWSOAnalysis, file_path: Path):
@@ -1854,7 +1892,7 @@ class VPCAnalyzer:
 ## Overview
 This analysis was conducted to support AWSO-05 VPC cleanup operations with comprehensive dependency validation and security compliance assessment.
 
-**Generated**: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}  
+**Generated**: {datetime.now().strftime("%Y-%m-%d %H:%M:%S")}  
 **Profile**: {self.profile}  
 **Region**: {self.region}
 
@@ -1869,13 +1907,13 @@ This analysis was conducted to support AWSO-05 VPC cleanup operations with compr
 - **Workload Impact Risk**: {"🔴 HIGH" if analysis.eni_gate_warnings else "🟢 LOW"}
 
 ### Cleanup Readiness
-**Status**: {analysis.evidence_bundle.get('CleanupReadiness', 'UNKNOWN')}
+**Status**: {analysis.evidence_bundle.get("CleanupReadiness", "UNKNOWN")}
 
 ## Recommendations
 
 """
         for rec in analysis.cleanup_recommendations:
-            priority_emoji = "🔴" if rec['Priority'] == 'CRITICAL' else "🟡" if rec['Priority'] == 'HIGH' else "🟢"
+            priority_emoji = "🔴" if rec["Priority"] == "CRITICAL" else "🟡" if rec["Priority"] == "HIGH" else "🟢"
             summary += f"### {priority_emoji} {rec['Priority']} Priority\n"
             summary += f"**Action**: {rec['Action']}  \n"
             summary += f"**Resource**: {rec['ResourceId']}  \n"
@@ -1896,30 +1934,30 @@ This analysis was conducted to support AWSO-05 VPC cleanup operations with compr
 ---
 *Generated by CloudOps-Runbooks AWSO-05 VPC Analyzer*
 """
-        
-        with open(file_path, 'w') as f:
+
+        with open(file_path, "w") as f:
             f.write(summary)
 
     def _create_evidence_manifest(self, evidence_files: Dict[str, str]) -> Dict[str, Any]:
         """Create evidence manifest with SHA256 checksums"""
         import hashlib
-        
+
         manifest = {
-            'ManifestVersion': '1.0',
-            'GeneratedAt': datetime.now().isoformat(),
-            'EvidenceFiles': list(evidence_files.keys()),
-            'FileCount': len(evidence_files),
-            'FileChecksums': {}
+            "ManifestVersion": "1.0",
+            "GeneratedAt": datetime.now().isoformat(),
+            "EvidenceFiles": list(evidence_files.keys()),
+            "FileCount": len(evidence_files),
+            "FileChecksums": {},
         }
-        
+
         # Generate SHA256 checksums
         for evidence_type, file_path in evidence_files.items():
             try:
-                with open(file_path, 'rb') as f:
+                with open(file_path, "rb") as f:
                     file_hash = hashlib.sha256(f.read()).hexdigest()
-                manifest['FileChecksums'][evidence_type] = file_hash
+                manifest["FileChecksums"][evidence_type] = file_hash
             except Exception as e:
                 logger.error(f"Failed to generate checksum for {file_path}: {e}")
-                manifest['FileChecksums'][evidence_type] = 'ERROR'
-        
-        return manifest
+                manifest["FileChecksums"][evidence_type] = "ERROR"
+
+        return manifest