runbooks 1.1.4__py3-none-any.whl → 1.1.6__py3-none-any.whl

runbooks/inventory/vpc_architecture_validator.py

@@ -12,7 +12,7 @@ assessment across multi-account AWS Organizations.
 
 **Architecture Focus**:
 - Multi-account Landing Zone architecture validation
-- AWS Well-Architected Framework compliance 
+- AWS Well-Architected Framework compliance
 - Network topology impact assessment
 - CIS Benchmark compliance validation
 - Cross-account dependency analysis
@@ -20,7 +20,7 @@ assessment across multi-account AWS Organizations.
 
 **Compliance Frameworks**:
 - CIS AWS Foundations Benchmark
-- AWS Well-Architected Security Pillar  
+- AWS Well-Architected Security Pillar
 - SOC2 Type II compliance requirements
 - Enterprise network governance standards
 
@@ -37,8 +37,14 @@ import boto3
 from botocore.exceptions import ClientError
 
 from runbooks.common.rich_utils import (
-    console, print_header, print_success, print_error, print_warning,
-    create_table, create_progress_bar, STATUS_INDICATORS
+    console,
+    print_header,
+    print_success,
+    print_error,
+    print_warning,
+    create_table,
+    create_progress_bar,
+    STATUS_INDICATORS,
 )
 
 logger = logging.getLogger(__name__)
@@ -47,7 +53,7 @@ logger = logging.getLogger(__name__)
 @dataclass
 class ArchitectureComplianceResult:
     """Architecture compliance validation result."""
-    
+
     framework: str  # CIS, Well-Architected, SOC2, etc.
     control_id: str
     control_description: str
@@ -61,246 +67,230 @@ class ArchitectureComplianceResult:
 @dataclass
 class AWSO5ArchitectureValidationResult:
     """Comprehensive AWSO-5 architecture validation result."""
-    
+
     vpc_id: str
     account_id: str
     region: str
-    
+
     # Architecture assessments
     well_architected_score: Dict[str, float] = field(default_factory=dict)
     cis_benchmark_compliance: Dict[str, str] = field(default_factory=dict)
     security_posture_score: float = 0.0
     network_impact_assessment: Dict[str, Any] = field(default_factory=dict)
-    
+
     # Compliance results
     compliance_results: List[ArchitectureComplianceResult] = field(default_factory=list)
     critical_findings: List[str] = field(default_factory=list)
     security_improvements: List[str] = field(default_factory=list)
-    
+
     # Business impact
     architecture_recommendation: str = "HOLD"  # DELETE, DELETE_WITH_REMEDIATION, HOLD, INVESTIGATE
     business_risk_level: str = "MEDIUM"  # LOW, MEDIUM, HIGH, CRITICAL
     estimated_security_improvement: float = 0.0
-    
+
     # Analysis metadata
     validation_timestamp: str = field(default_factory=lambda: datetime.utcnow().isoformat())
     validation_duration_seconds: float = 0.0
     validation_accuracy: float = 100.0
-    
+
     @property
     def overall_compliance_score(self) -> float:
         """Calculate overall compliance score from all frameworks."""
         if not self.compliance_results:
             return 0.0
-        
+
         total_weight = 0
         weighted_score = 0
-        
+
         for result in self.compliance_results:
             weight = self._get_control_weight(result.framework, result.impact_level)
             total_weight += weight
-            
+
             if result.compliance_status == "PASS":
                 weighted_score += weight * 1.0
             elif result.compliance_status == "WARNING":
                 weighted_score += weight * 0.5
             # FAIL and NOT_APPLICABLE contribute 0
-        
+
         return (weighted_score / total_weight * 100) if total_weight > 0 else 0.0
-    
+
     def _get_control_weight(self, framework: str, impact_level: str) -> float:
         """Get weight for compliance control based on framework and impact."""
-        framework_weights = {
-            'CIS': 3.0,
-            'Well-Architected': 2.5, 
-            'SOC2': 2.0,
-            'Enterprise': 1.5
-        }
-        
-        impact_multipliers = {
-            'CRITICAL': 4.0,
-            'HIGH': 3.0,
-            'MEDIUM': 2.0,
-            'LOW': 1.0
-        }
-        
+        framework_weights = {"CIS": 3.0, "Well-Architected": 2.5, "SOC2": 2.0, "Enterprise": 1.5}
+
+        impact_multipliers = {"CRITICAL": 4.0, "HIGH": 3.0, "MEDIUM": 2.0, "LOW": 1.0}
+
         base_weight = framework_weights.get(framework, 1.0)
         multiplier = impact_multipliers.get(impact_level, 1.0)
-        
+
         return base_weight * multiplier
 
 
 class AWSO5ArchitectureValidator:
     """
     AWSO-5 Multi-Account Architecture Validator.
-    
+
     Comprehensive architecture validation for VPC cleanup with enterprise
     compliance checking, security posture assessment, and business risk analysis.
-    
+
     **Enterprise Integration**:
     - Multi-account AWS Organizations support
     - Well-Architected Framework assessment
-    - CIS Benchmark compliance validation  
+    - CIS Benchmark compliance validation
     - Cross-account dependency analysis
     - Security baseline enforcement
     - Network topology impact assessment
     """
-    
+
     def __init__(self, session: Optional[boto3.Session] = None, region: str = "us-east-1"):
         """Initialize AWSO-5 architecture validator."""
         self.session = session or boto3.Session()
         self.region = region
         self.console = console
-        
+
         # Initialize AWS clients
         self._ec2_client = None
         self._organizations_client = None
         self._config_client = None
         self._cloudtrail_client = None
-        
+
         # Validation tracking
         self.validation_results: Dict[str, AWSO5ArchitectureValidationResult] = {}
-        
+
     @property
     def ec2_client(self):
         """Lazy-loaded EC2 client."""
         if not self._ec2_client:
-            self._ec2_client = self.session.client('ec2', region_name=self.region)
+            self._ec2_client = self.session.client("ec2", region_name=self.region)
         return self._ec2_client
-    
+
     @property
     def organizations_client(self):
         """Lazy-loaded Organizations client."""
         if not self._organizations_client:
-            self._organizations_client = self.session.client('organizations', region_name='us-east-1')
+            self._organizations_client = self.session.client("organizations", region_name="us-east-1")
         return self._organizations_client
-    
+
     @property
     def config_client(self):
         """Lazy-loaded Config client."""
         if not self._config_client:
-            self._config_client = self.session.client('config', region_name=self.region)
+            self._config_client = self.session.client("config", region_name=self.region)
         return self._config_client
-    
+
     @property
     def cloudtrail_client(self):
         """Lazy-loaded CloudTrail client."""
         if not self._cloudtrail_client:
-            self._cloudtrail_client = self.session.client('cloudtrail', region_name=self.region)
+            self._cloudtrail_client = self.session.client("cloudtrail", region_name=self.region)
         return self._cloudtrail_client
-    
+
     def validate_vpc_architecture(self, vpc_id: str) -> AWSO5ArchitectureValidationResult:
         """
         Comprehensive VPC architecture validation for AWSO-5 compliance.
-        
+
         Performs multi-dimensional architecture assessment including security
         posture, compliance frameworks, network impact, and business risk analysis.
-        
+
         Args:
             vpc_id: AWS VPC identifier to validate
-            
+
         Returns:
             Comprehensive architecture validation results
         """
         start_time = datetime.utcnow()
-        
+
         # Get VPC and account information
         vpc_info = self._get_vpc_info(vpc_id)
         if not vpc_info:
             raise ValueError(f"VPC {vpc_id} not found in region {self.region}")
-        
-        account_id = self.session.client('sts').get_caller_identity()['Account']
-        
-        result = AWSO5ArchitectureValidationResult(
-            vpc_id=vpc_id,
-            account_id=account_id,
-            region=self.region
-        )
-        
+
+        account_id = self.session.client("sts").get_caller_identity()["Account"]
+
+        result = AWSO5ArchitectureValidationResult(vpc_id=vpc_id, account_id=account_id, region=self.region)
+
         print_header("AWSO-5 Architecture Validation", "1.0.0")
         self.console.print(f"\n[blue]VPC Architecture Analysis:[/blue] {vpc_id}")
         self.console.print(f"[blue]Account:[/blue] {account_id}")
         self.console.print(f"[blue]Region:[/blue] {self.region}")
-        
+
         # Validation phases
         self.console.print("\n[yellow]Phase 1: CIS Benchmark Compliance[/yellow]")
         self._validate_cis_benchmark_compliance(vpc_id, vpc_info, result)
-        
-        self.console.print("\n[yellow]Phase 2: AWS Well-Architected Assessment[/yellow]") 
+
+        self.console.print("\n[yellow]Phase 2: AWS Well-Architected Assessment[/yellow]")
         self._validate_well_architected_framework(vpc_id, vpc_info, result)
-        
+
         self.console.print("\n[yellow]Phase 3: Security Posture Analysis[/yellow]")
         self._analyze_security_posture(vpc_id, vpc_info, result)
-        
+
         self.console.print("\n[yellow]Phase 4: Network Impact Assessment[/yellow]")
         self._assess_network_impact(vpc_id, vpc_info, result)
-        
+
         self.console.print("\n[yellow]Phase 5: Business Risk Analysis[/yellow]")
         self._analyze_business_risk(vpc_id, vpc_info, result)
-        
+
         # Calculate final metrics
         end_time = datetime.utcnow()
         result.validation_duration_seconds = (end_time - start_time).total_seconds()
         result.security_posture_score = self._calculate_security_posture_score(result)
-        
+
         # Generate architecture recommendation
         self._generate_architecture_recommendation(result)
-        
+
         # Store results for evidence collection
         self.validation_results[vpc_id] = result
-        
+
         # Display comprehensive results
         self._display_validation_results(result)
-        
+
         return result
-    
+
     def _get_vpc_info(self, vpc_id: str) -> Optional[Dict[str, Any]]:
         """Get comprehensive VPC information."""
         try:
             response = self.ec2_client.describe_vpcs(VpcIds=[vpc_id])
-            return response['Vpcs'][0] if response['Vpcs'] else None
+            return response["Vpcs"][0] if response["Vpcs"] else None
         except ClientError as e:
             print_error(f"Failed to get VPC info: {e}")
             return None
-    
+
     def _validate_cis_benchmark_compliance(
-        self, 
-        vpc_id: str, 
-        vpc_info: Dict[str, Any], 
-        result: AWSO5ArchitectureValidationResult
+        self, vpc_id: str, vpc_info: Dict[str, Any], result: AWSO5ArchitectureValidationResult
     ):
         """Validate CIS AWS Foundations Benchmark compliance."""
-        
+
         # CIS Control 4.1: Ensure no security groups allow ingress from 0.0.0.0/0 to port 22
         self._check_cis_4_1_ssh_access(vpc_id, result)
-        
-        # CIS Control 4.2: Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389  
+
+        # CIS Control 4.2: Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389
         self._check_cis_4_2_rdp_access(vpc_id, result)
-        
+
         # CIS Control 4.3: Ensure the default security group restricts all traffic
         self._check_cis_4_3_default_security_group(vpc_id, result)
-        
+
         # CIS Control 2.6: Ensure VPC flow logging is enabled
         self._check_cis_2_6_vpc_flow_logging(vpc_id, result)
-        
+
         # Default VPC specific checks
-        if vpc_info.get('IsDefault', False):
+        if vpc_info.get("IsDefault", False):
             self._check_default_vpc_compliance(vpc_id, vpc_info, result)
-    
+
     def _check_cis_4_1_ssh_access(self, vpc_id: str, result: AWSO5ArchitectureValidationResult):
         """Check CIS 4.1: SSH access from 0.0.0.0/0."""
         try:
-            response = self.ec2_client.describe_security_groups(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]
-            )
-            
+            response = self.ec2_client.describe_security_groups(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])
+
             violations = []
-            for sg in response['SecurityGroups']:
-                for rule in sg.get('IpPermissions', []):
-                    if (rule.get('FromPort') == 22 and rule.get('ToPort') == 22 and
-                        any(ip_range.get('CidrIp') == '0.0.0.0/0' for ip_range in rule.get('IpRanges', []))):
+            for sg in response["SecurityGroups"]:
+                for rule in sg.get("IpPermissions", []):
+                    if (
+                        rule.get("FromPort") == 22
+                        and rule.get("ToPort") == 22
+                        and any(ip_range.get("CidrIp") == "0.0.0.0/0" for ip_range in rule.get("IpRanges", []))
+                    ):
                         violations.append(f"Security Group {sg['GroupId']} ({sg['GroupName']})")
-            
+
             if violations:
                 compliance_result = ArchitectureComplianceResult(
                     framework="CIS",
@@ -309,7 +299,7 @@ class AWSO5ArchitectureValidator:
                     compliance_status="FAIL",
                     impact_level="HIGH",
                     findings=violations,
-                    remediation_guidance="Restrict SSH access to specific IP ranges"
+                    remediation_guidance="Restrict SSH access to specific IP ranges",
                 )
                 result.critical_findings.extend(violations)
             else:
@@ -318,29 +308,30 @@ class AWSO5ArchitectureValidator:
                     control_id="4.1",
                     control_description="No security groups allow ingress from 0.0.0.0/0 to port 22",
                     compliance_status="PASS",
-                    impact_level="HIGH"
+                    impact_level="HIGH",
                 )
-            
+
             result.compliance_results.append(compliance_result)
             result.cis_benchmark_compliance["4.1"] = compliance_result.compliance_status
-            
+
         except ClientError as e:
             print_warning(f"CIS 4.1 check failed: {e}")
-    
+
     def _check_cis_4_2_rdp_access(self, vpc_id: str, result: AWSO5ArchitectureValidationResult):
         """Check CIS 4.2: RDP access from 0.0.0.0/0."""
         try:
-            response = self.ec2_client.describe_security_groups(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]
-            )
-            
+            response = self.ec2_client.describe_security_groups(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])
+
             violations = []
-            for sg in response['SecurityGroups']:
-                for rule in sg.get('IpPermissions', []):
-                    if (rule.get('FromPort') == 3389 and rule.get('ToPort') == 3389 and
-                        any(ip_range.get('CidrIp') == '0.0.0.0/0' for ip_range in rule.get('IpRanges', []))):
+            for sg in response["SecurityGroups"]:
+                for rule in sg.get("IpPermissions", []):
+                    if (
+                        rule.get("FromPort") == 3389
+                        and rule.get("ToPort") == 3389
+                        and any(ip_range.get("CidrIp") == "0.0.0.0/0" for ip_range in rule.get("IpRanges", []))
+                    ):
                         violations.append(f"Security Group {sg['GroupId']} ({sg['GroupName']})")
-            
+
             if violations:
                 compliance_result = ArchitectureComplianceResult(
                     framework="CIS",
@@ -349,49 +340,46 @@ class AWSO5ArchitectureValidator:
                     compliance_status="FAIL",
                     impact_level="HIGH",
                     findings=violations,
-                    remediation_guidance="Restrict RDP access to specific IP ranges"
+                    remediation_guidance="Restrict RDP access to specific IP ranges",
                 )
                 result.critical_findings.extend(violations)
             else:
                 compliance_result = ArchitectureComplianceResult(
                     framework="CIS",
-                    control_id="4.2", 
+                    control_id="4.2",
                     control_description="No security groups allow ingress from 0.0.0.0/0 to port 3389",
                     compliance_status="PASS",
-                    impact_level="HIGH"
+                    impact_level="HIGH",
                 )
-            
+
             result.compliance_results.append(compliance_result)
             result.cis_benchmark_compliance["4.2"] = compliance_result.compliance_status
-            
+
         except ClientError as e:
             print_warning(f"CIS 4.2 check failed: {e}")
-    
+
     def _check_cis_4_3_default_security_group(self, vpc_id: str, result: AWSO5ArchitectureValidationResult):
         """Check CIS 4.3: Default security group restrictions."""
         try:
             response = self.ec2_client.describe_security_groups(
-                Filters=[
-                    {'Name': 'vpc-id', 'Values': [vpc_id]},
-                    {'Name': 'group-name', 'Values': ['default']}
-                ]
+                Filters=[{"Name": "vpc-id", "Values": [vpc_id]}, {"Name": "group-name", "Values": ["default"]}]
             )
-            
+
             violations = []
-            for sg in response['SecurityGroups']:
-                if sg.get('IpPermissions') or sg.get('IpPermissionsEgress'):
+            for sg in response["SecurityGroups"]:
+                if sg.get("IpPermissions") or sg.get("IpPermissionsEgress"):
                     # Default SG should have no rules
                     violations.append(f"Default Security Group {sg['GroupId']} has active rules")
-            
+
             if violations:
                 compliance_result = ArchitectureComplianceResult(
                     framework="CIS",
                     control_id="4.3",
                     control_description="Default security group restricts all traffic",
-                    compliance_status="FAIL", 
+                    compliance_status="FAIL",
                     impact_level="MEDIUM",
                     findings=violations,
-                    remediation_guidance="Remove all rules from default security group"
+                    remediation_guidance="Remove all rules from default security group",
                 )
             else:
                 compliance_result = ArchitectureComplianceResult(
@@ -399,30 +387,24 @@ class AWSO5ArchitectureValidator:
                     control_id="4.3",
                     control_description="Default security group restricts all traffic",
                     compliance_status="PASS",
-                    impact_level="MEDIUM"
+                    impact_level="MEDIUM",
                 )
-            
+
             result.compliance_results.append(compliance_result)
             result.cis_benchmark_compliance["4.3"] = compliance_result.compliance_status
-            
+
         except ClientError as e:
             print_warning(f"CIS 4.3 check failed: {e}")
-    
+
     def _check_cis_2_6_vpc_flow_logging(self, vpc_id: str, result: AWSO5ArchitectureValidationResult):
         """Check CIS 2.6: VPC Flow Logs enabled."""
         try:
             response = self.ec2_client.describe_flow_logs(
-                Filters=[
-                    {'Name': 'resource-id', 'Values': [vpc_id]},
-                    {'Name': 'resource-type', 'Values': ['VPC']}
-                ]
+                Filters=[{"Name": "resource-id", "Values": [vpc_id]}, {"Name": "resource-type", "Values": ["VPC"]}]
             )
-            
-            active_flow_logs = [
-                fl for fl in response['FlowLogs'] 
-                if fl['FlowLogStatus'] == 'ACTIVE'
-            ]
-            
+
+            active_flow_logs = [fl for fl in response["FlowLogs"] if fl["FlowLogStatus"] == "ACTIVE"]
+
             if not active_flow_logs:
                 compliance_result = ArchitectureComplianceResult(
                     framework="CIS",
@@ -431,7 +413,7 @@ class AWSO5ArchitectureValidator:
                     compliance_status="FAIL",
                     impact_level="MEDIUM",
                     findings=[f"VPC {vpc_id} has no active flow logs"],
-                    remediation_guidance="Enable VPC Flow Logs for security monitoring"
+                    remediation_guidance="Enable VPC Flow Logs for security monitoring",
                 )
             else:
                 compliance_result = ArchitectureComplianceResult(
@@ -439,23 +421,20 @@ class AWSO5ArchitectureValidator:
                     control_id="2.6",
                     control_description="VPC Flow Logging is enabled",
                     compliance_status="PASS",
-                    impact_level="MEDIUM"
+                    impact_level="MEDIUM",
                 )
-            
+
             result.compliance_results.append(compliance_result)
             result.cis_benchmark_compliance["2.6"] = compliance_result.compliance_status
-            
+
         except ClientError as e:
             print_warning(f"CIS 2.6 check failed: {e}")
-    
+
     def _check_default_vpc_compliance(
-        self, 
-        vpc_id: str, 
-        vpc_info: Dict[str, Any], 
-        result: AWSO5ArchitectureValidationResult
+        self, vpc_id: str, vpc_info: Dict[str, Any], result: AWSO5ArchitectureValidationResult
     ):
         """Special compliance checks for default VPCs."""
-        
+
         # Default VPC should be deleted per CIS recommendations
         compliance_result = ArchitectureComplianceResult(
             framework="CIS",
@@ -464,83 +443,77 @@ class AWSO5ArchitectureValidator:
             compliance_status="FAIL",
             impact_level="CRITICAL",
             findings=[f"Default VPC {vpc_id} exists in region {self.region}"],
-            remediation_guidance="Delete default VPC to improve security posture and CIS compliance"
+            remediation_guidance="Delete default VPC to improve security posture and CIS compliance",
         )
-        
+
         result.compliance_results.append(compliance_result)
         result.cis_benchmark_compliance["DEFAULT_VPC"] = "FAIL"
         result.critical_findings.append(f"Default VPC {vpc_id} requires deletion")
         result.security_improvements.append("Default VPC elimination improves CIS Benchmark compliance")
-    
+
     def _validate_well_architected_framework(
-        self, 
-        vpc_id: str, 
-        vpc_info: Dict[str, Any], 
-        result: AWSO5ArchitectureValidationResult
+        self, vpc_id: str, vpc_info: Dict[str, Any], result: AWSO5ArchitectureValidationResult
     ):
         """Validate against AWS Well-Architected Framework principles."""
-        
+
         # Security Pillar Assessment
         security_score = self._assess_security_pillar(vpc_id, vpc_info, result)
         result.well_architected_score["Security"] = security_score
-        
+
         # Reliability Pillar Assessment
         reliability_score = self._assess_reliability_pillar(vpc_id, vpc_info, result)
         result.well_architected_score["Reliability"] = reliability_score
-        
-        # Performance Efficiency Assessment  
+
+        # Performance Efficiency Assessment
         performance_score = self._assess_performance_pillar(vpc_id, vpc_info, result)
         result.well_architected_score["Performance"] = performance_score
-        
+
         # Cost Optimization Assessment
         cost_score = self._assess_cost_pillar(vpc_id, vpc_info, result)
         result.well_architected_score["Cost"] = cost_score
-        
+
         # Operational Excellence Assessment
         ops_score = self._assess_operational_pillar(vpc_id, vpc_info, result)
         result.well_architected_score["Operational"] = ops_score
-    
+
     def _assess_security_pillar(
-        self, 
-        vpc_id: str, 
-        vpc_info: Dict[str, Any], 
-        result: AWSO5ArchitectureValidationResult
+        self, vpc_id: str, vpc_info: Dict[str, Any], result: AWSO5ArchitectureValidationResult
     ) -> float:
         """Assess Well-Architected Security Pillar."""
-        
+
         security_checks = []
-        
+
         # SEC-3: Apply security in depth principle
         try:
             # Check for NACLs and Security Groups
-            nacls = self.ec2_client.describe_network_acls(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]
-            )['NetworkAcls']
-            
-            sgs = self.ec2_client.describe_security_groups(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]  
-            )['SecurityGroups']
-            
+            nacls = self.ec2_client.describe_network_acls(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])[
+                "NetworkAcls"
+            ]
+
+            sgs = self.ec2_client.describe_security_groups(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])[
+                "SecurityGroups"
+            ]
+
             if len(nacls) > 1 or len(sgs) > 1:  # More than just defaults
                 security_checks.append(("Defense in Depth", "PASS"))
             else:
                 security_checks.append(("Defense in Depth", "FAIL"))
-                
+
         except ClientError:
             security_checks.append(("Defense in Depth", "UNKNOWN"))
-        
+
         # SEC-9: Protect data in transit and at rest
-        if vpc_info.get('IsDefault', False):
+        if vpc_info.get("IsDefault", False):
             security_checks.append(("Default VPC Security", "FAIL"))
             result.security_improvements.append("Default VPC replacement improves data protection")
         else:
             security_checks.append(("Default VPC Security", "PASS"))
-        
+
         # Calculate security score
         passed = len([check for check in security_checks if check[1] == "PASS"])
         total = len(security_checks)
         score = (passed / total * 100) if total > 0 else 0
-        
+
         # Add Well-Architected compliance result
         compliance_result = ArchitectureComplianceResult(
             framework="Well-Architected",
@@ -549,252 +522,221 @@ class AWSO5ArchitectureValidator:
             compliance_status="PASS" if score >= 80 else "WARNING" if score >= 60 else "FAIL",
             impact_level="HIGH",
             findings=[f"Security score: {score:.1f}% ({passed}/{total} checks passed)"],
-            remediation_guidance="Implement defense in depth and eliminate default VPCs"
+            remediation_guidance="Implement defense in depth and eliminate default VPCs",
         )
-        
+
         result.compliance_results.append(compliance_result)
-        
+
         return score
-    
+
     def _assess_reliability_pillar(
-        self,
-        vpc_id: str,
-        vpc_info: Dict[str, Any], 
-        result: AWSO5ArchitectureValidationResult
+        self, vpc_id: str, vpc_info: Dict[str, Any], result: AWSO5ArchitectureValidationResult
     ) -> float:
         """Assess Well-Architected Reliability Pillar."""
-        
+
         reliability_checks = []
-        
+
         # REL-1: Multi-AZ deployment capability
         try:
-            subnets = self.ec2_client.describe_subnets(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]
-            )['Subnets']
-            
-            azs = set(subnet['AvailabilityZone'] for subnet in subnets)
+            subnets = self.ec2_client.describe_subnets(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])["Subnets"]
+
+            azs = set(subnet["AvailabilityZone"] for subnet in subnets)
             if len(azs) >= 2:
                 reliability_checks.append(("Multi-AZ Support", "PASS"))
             else:
                 reliability_checks.append(("Multi-AZ Support", "WARNING"))
-                
+
         except ClientError:
             reliability_checks.append(("Multi-AZ Support", "UNKNOWN"))
-        
+
         # Calculate reliability score
         passed = len([check for check in reliability_checks if check[1] == "PASS"])
-        total = len(reliability_checks) 
+        total = len(reliability_checks)
         score = (passed / total * 100) if total > 0 else 0
-        
+
         return score
-    
+
     def _assess_performance_pillar(
-        self,
-        vpc_id: str,
-        vpc_info: Dict[str, Any],
-        result: AWSO5ArchitectureValidationResult
+        self, vpc_id: str, vpc_info: Dict[str, Any], result: AWSO5ArchitectureValidationResult
     ) -> float:
         """Assess Well-Architected Performance Efficiency Pillar."""
-        
+
         performance_checks = []
-        
+
         # PERF-1: Network performance optimization
         try:
             # Check for VPC endpoints (reduce data transfer costs)
-            endpoints = self.ec2_client.describe_vpc_endpoints(
-                Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]
-            )['VpcEndpoints']
-            
+            endpoints = self.ec2_client.describe_vpc_endpoints(Filters=[{"Name": "vpc-id", "Values": [vpc_id]}])[
+                "VpcEndpoints"
+            ]
+
             if endpoints:
                 performance_checks.append(("VPC Endpoints Optimization", "PASS"))
             else:
                 performance_checks.append(("VPC Endpoints Optimization", "WARNING"))
-                
+
         except ClientError:
             performance_checks.append(("VPC Endpoints Optimization", "UNKNOWN"))
-        
+
         # Calculate performance score
         passed = len([check for check in performance_checks if check[1] == "PASS"])
         total = len(performance_checks)
         score = (passed / total * 100) if total > 0 else 50  # Neutral score if no checks
-        
+
         return score
-    
+
     def _assess_cost_pillar(
-        self,
-        vpc_id: str,
-        vpc_info: Dict[str, Any],
-        result: AWSO5ArchitectureValidationResult
+        self, vpc_id: str, vpc_info: Dict[str, Any], result: AWSO5ArchitectureValidationResult
     ) -> float:
         """Assess Well-Architected Cost Optimization Pillar."""
-        
+
         cost_checks = []
-        
+
         # COST-1: Unused resource identification
-        if vpc_info.get('IsDefault', False):
+        if vpc_info.get("IsDefault", False):
             cost_checks.append(("Default VPC Cost Impact", "FAIL"))
             result.estimated_security_improvement += 25.0  # Monthly savings estimate
         else:
             cost_checks.append(("Default VPC Cost Impact", "PASS"))
-        
+
         # Calculate cost score
         passed = len([check for check in cost_checks if check[1] == "PASS"])
         total = len(cost_checks)
         score = (passed / total * 100) if total > 0 else 0
-        
+
         return score
-    
+
     def _assess_operational_pillar(
-        self,
-        vpc_id: str,
-        vpc_info: Dict[str, Any],
-        result: AWSO5ArchitectureValidationResult
+        self, vpc_id: str, vpc_info: Dict[str, Any], result: AWSO5ArchitectureValidationResult
     ) -> float:
         """Assess Well-Architected Operational Excellence Pillar."""
-        
+
         ops_checks = []
-        
+
         # OPS-1: Infrastructure as Code usage
         # This would require additional analysis of CloudFormation/Terraform
         ops_checks.append(("Infrastructure as Code", "UNKNOWN"))
-        
+
         # Calculate operational score
         score = 50  # Neutral score - requires additional IaC analysis
-        
+
         return score
-    
+
     def _analyze_security_posture(
-        self,
-        vpc_id: str, 
-        vpc_info: Dict[str, Any],
-        result: AWSO5ArchitectureValidationResult
+        self, vpc_id: str, vpc_info: Dict[str, Any], result: AWSO5ArchitectureValidationResult
     ):
         """Comprehensive security posture analysis."""
-        
+
         # Security baseline checks
         security_findings = []
-        
+
         # Default VPC security impact
-        if vpc_info.get('IsDefault', False):
+        if vpc_info.get("IsDefault", False):
             security_findings.append("Default VPC presents increased attack surface")
             security_findings.append("Default security groups may have overly permissive rules")
             security_findings.append("Default infrastructure lacks security hardening")
-            
-            result.security_improvements.extend([
-                "Default VPC elimination reduces attack surface by ~30%",
-                "Custom VPC implementation enables security best practices",
-                "Network segmentation improves compliance posture"
-            ])
-    
-    def _assess_network_impact(
-        self,
-        vpc_id: str,
-        vpc_info: Dict[str, Any], 
-        result: AWSO5ArchitectureValidationResult
-    ):
+
+            result.security_improvements.extend(
+                [
+                    "Default VPC elimination reduces attack surface by ~30%",
+                    "Custom VPC implementation enables security best practices",
+                    "Network segmentation improves compliance posture",
+                ]
+            )
+
+    def _assess_network_impact(self, vpc_id: str, vpc_info: Dict[str, Any], result: AWSO5ArchitectureValidationResult):
         """Assess network topology impact of VPC cleanup."""
-        
+
         network_impact = {
-            'connectivity_impact': 'NONE',  # NONE, LOW, MEDIUM, HIGH
-            'routing_changes_required': False,
-            'cross_account_dependencies': [],
-            'transit_gateway_impact': False,
-            'peering_connections_affected': 0
+            "connectivity_impact": "NONE",  # NONE, LOW, MEDIUM, HIGH
+            "routing_changes_required": False,
+            "cross_account_dependencies": [],
+            "transit_gateway_impact": False,
+            "peering_connections_affected": 0,
         }
-        
+
         try:
             # Check for transit gateway attachments
             tgw_attachments = self.ec2_client.describe_transit_gateway_attachments(
-                Filters=[
-                    {'Name': 'resource-id', 'Values': [vpc_id]},
-                    {'Name': 'resource-type', 'Values': ['vpc']}
-                ]
-            )['TransitGatewayAttachments']
-            
+                Filters=[{"Name": "resource-id", "Values": [vpc_id]}, {"Name": "resource-type", "Values": ["vpc"]}]
+            )["TransitGatewayAttachments"]
+
             if tgw_attachments:
-                network_impact['transit_gateway_impact'] = True
-                network_impact['connectivity_impact'] = 'HIGH'
-            
+                network_impact["transit_gateway_impact"] = True
+                network_impact["connectivity_impact"] = "HIGH"
+
             # Check for VPC peering connections
             peering_response = self.ec2_client.describe_vpc_peering_connections(
-                Filters=[
-                    {'Name': 'accepter-vpc-info.vpc-id', 'Values': [vpc_id]}
-                ]
+                Filters=[{"Name": "accepter-vpc-info.vpc-id", "Values": [vpc_id]}]
             )
             peering_response2 = self.ec2_client.describe_vpc_peering_connections(
-                Filters=[
-                    {'Name': 'requester-vpc-info.vpc-id', 'Values': [vpc_id]}
-                ]
+                Filters=[{"Name": "requester-vpc-info.vpc-id", "Values": [vpc_id]}]
             )
-            
-            total_peering = len(peering_response['VpcPeeringConnections']) + len(peering_response2['VpcPeeringConnections'])
-            network_impact['peering_connections_affected'] = total_peering
-            
+
+            total_peering = len(peering_response["VpcPeeringConnections"]) + len(
+                peering_response2["VpcPeeringConnections"]
+            )
+            network_impact["peering_connections_affected"] = total_peering
+
             if total_peering > 0:
-                if network_impact['connectivity_impact'] == 'NONE':
-                    network_impact['connectivity_impact'] = 'MEDIUM'
-        
+                if network_impact["connectivity_impact"] == "NONE":
+                    network_impact["connectivity_impact"] = "MEDIUM"
+
         except ClientError as e:
             print_warning(f"Network impact assessment failed: {e}")
-        
+
         result.network_impact_assessment = network_impact
-    
-    def _analyze_business_risk(
-        self,
-        vpc_id: str,
-        vpc_info: Dict[str, Any],
-        result: AWSO5ArchitectureValidationResult
-    ):
+
+    def _analyze_business_risk(self, vpc_id: str, vpc_info: Dict[str, Any], result: AWSO5ArchitectureValidationResult):
         """Comprehensive business risk analysis."""
-        
+
         risk_factors = []
         risk_level = "LOW"
-        
+
         # Default VPC risk assessment
-        if vpc_info.get('IsDefault', False):
+        if vpc_info.get("IsDefault", False):
             risk_factors.append("Default VPC increases security risk")
             risk_factors.append("Non-compliance with CIS Benchmark")
             risk_factors.append("Potential audit findings")
             risk_level = "MEDIUM"
-        
+
         # Network connectivity risk
-        if result.network_impact_assessment.get('connectivity_impact') == 'HIGH':
-            risk_factors.append("High network connectivity impact") 
+        if result.network_impact_assessment.get("connectivity_impact") == "HIGH":
+            risk_factors.append("High network connectivity impact")
             risk_level = "HIGH"
-        elif result.network_impact_assessment.get('connectivity_impact') == 'MEDIUM':
+        elif result.network_impact_assessment.get("connectivity_impact") == "MEDIUM":
             risk_factors.append("Medium network connectivity impact")
             if risk_level == "LOW":
                 risk_level = "MEDIUM"
-        
+
         # Compliance risk
-        critical_failures = len([
-            cr for cr in result.compliance_results 
-            if cr.compliance_status == "FAIL" and cr.impact_level == "CRITICAL"
-        ])
-        
+        critical_failures = len(
+            [cr for cr in result.compliance_results if cr.compliance_status == "FAIL" and cr.impact_level == "CRITICAL"]
+        )
+
         if critical_failures > 0:
             risk_factors.append(f"{critical_failures} critical compliance failures")
             risk_level = "HIGH"
-        
+
         result.business_risk_level = risk_level
-    
+
     def _calculate_security_posture_score(self, result: AWSO5ArchitectureValidationResult) -> float:
         """Calculate comprehensive security posture score."""
-        
+
         # Base score from compliance results
         compliance_score = result.overall_compliance_score
-        
+
         # Well-Architected security score
         security_pillar_score = result.well_architected_score.get("Security", 0)
-        
+
         # Weighted combination
         weighted_score = (compliance_score * 0.6) + (security_pillar_score * 0.4)
-        
+
         return weighted_score
-    
+
     def _generate_architecture_recommendation(self, result: AWSO5ArchitectureValidationResult):
         """Generate architecture-based cleanup recommendation."""
-        
+
         # Decision logic based on multiple factors
         if result.business_risk_level == "LOW" and result.overall_compliance_score >= 80:
             result.architecture_recommendation = "DELETE"
@@ -807,53 +749,59 @@ class AWSO5ArchitectureValidator:
             result.architecture_recommendation = "INVESTIGATE"
         else:
             result.architecture_recommendation = "HOLD"
-    
+
     def _display_validation_results(self, result: AWSO5ArchitectureValidationResult):
         """Display comprehensive architecture validation results."""
-        
+
         # Summary table
         summary_table = create_table(title="AWSO-5 Architecture Validation Summary")
         summary_table.add_column("Metric", style="cyan", no_wrap=True)
         summary_table.add_column("Score/Status", style="green")
         summary_table.add_column("Impact", style="yellow")
-        
+
         summary_table.add_row("Overall Compliance Score", f"{result.overall_compliance_score:.1f}%", "")
         summary_table.add_row("Security Posture Score", f"{result.security_posture_score:.1f}%", "")
-        summary_table.add_row("Business Risk Level", result.business_risk_level, 
-                             "Requires Review" if result.business_risk_level in ["HIGH", "CRITICAL"] else "Acceptable")
+        summary_table.add_row(
+            "Business Risk Level",
+            result.business_risk_level,
+            "Requires Review" if result.business_risk_level in ["HIGH", "CRITICAL"] else "Acceptable",
+        )
         summary_table.add_row("Architecture Recommendation", result.architecture_recommendation, "")
-        summary_table.add_row("Critical Findings", str(len(result.critical_findings)), 
-                             "Action Required" if result.critical_findings else "None")
-        
+        summary_table.add_row(
+            "Critical Findings",
+            str(len(result.critical_findings)),
+            "Action Required" if result.critical_findings else "None",
+        )
+
         self.console.print("\n")
         self.console.print(summary_table)
-        
+
         # Well-Architected Scores
         if result.well_architected_score:
             wa_table = create_table(title="AWS Well-Architected Framework Assessment")
             wa_table.add_column("Pillar", style="cyan")
             wa_table.add_column("Score", style="green")
             wa_table.add_column("Status", style="yellow")
-            
+
             for pillar, score in result.well_architected_score.items():
                 status = "GOOD" if score >= 80 else "FAIR" if score >= 60 else "NEEDS IMPROVEMENT"
                 wa_table.add_row(pillar, f"{score:.1f}%", status)
-            
+
             self.console.print("\n")
             self.console.print(wa_table)
-        
+
         # Critical Findings
         if result.critical_findings:
             self.console.print("\n[red]🚨 Critical Findings:[/red]")
             for finding in result.critical_findings:
                 self.console.print(f"  • {finding}")
-        
+
         # Security Improvements
         if result.security_improvements:
             self.console.print("\n[green]🔒 Security Improvements:[/green]")
             for improvement in result.security_improvements:
                 self.console.print(f"  • {improvement}")
-        
+
         # Architecture Recommendation
         if result.architecture_recommendation == "DELETE":
             status = "[green]✅ APPROVED FOR DELETION[/green]"
@@ -863,7 +811,7 @@ class AWSO5ArchitectureValidator:
             status = "[red]🔍 REQUIRES INVESTIGATION[/red]"
         else:
             status = "[red]⛔ HOLD - DO NOT DELETE[/red]"
-        
+
         recommendation_text = f"""
 {status}
 
@@ -875,65 +823,62 @@ class AWSO5ArchitectureValidator:
 **Next Steps:**
 {self._get_architecture_next_steps(result)}
         """
-        
+
         from rich.panel import Panel
+
         recommendation_panel = Panel(
-            recommendation_text,
-            title="🏗️ Architecture Validation Recommendation", 
-            border_style="blue"
+            recommendation_text, title="🏗️ Architecture Validation Recommendation", border_style="blue"
         )
-        
+
         self.console.print("\n")
         self.console.print(recommendation_panel)
-    
+
     def _get_architecture_next_steps(self, result: AWSO5ArchitectureValidationResult) -> str:
         """Generate architecture-specific next steps."""
-        
+
         if result.architecture_recommendation == "DELETE":
             return "• Architecture validation PASSED\n• Proceed with VPC cleanup\n• Update compliance documentation"
-        
+
         elif result.architecture_recommendation == "DELETE_WITH_REMEDIATION":
             return "• Address critical findings first\n• Implement security improvements\n• Re-validate architecture compliance"
-        
+
         elif result.architecture_recommendation == "INVESTIGATE":
             return "• Detailed risk assessment required\n• Stakeholder consultation needed\n• Consider alternative remediation approaches"
-        
+
         else:  # HOLD
             return "• High-risk operation detected\n• Comprehensive architecture review required\n• Platform Lead consultation mandatory"
 
 
 def validate_vpc_architecture_cli(
-    vpc_id: str, 
-    profile: Optional[str] = None, 
-    region: str = "us-east-1"
+    vpc_id: str, profile: Optional[str] = None, region: str = "us-east-1"
 ) -> AWSO5ArchitectureValidationResult:
     """
     CLI wrapper for VPC architecture validation.
-    
+
     Args:
         vpc_id: AWS VPC identifier
         profile: AWS profile name
         region: AWS region
-        
+
     Returns:
         Comprehensive architecture validation results
     """
     session = boto3.Session(profile_name=profile) if profile else boto3.Session()
     validator = AWSO5ArchitectureValidator(session=session, region=region)
-    
+
     return validator.validate_vpc_architecture(vpc_id)
 
 
 if __name__ == "__main__":
     import argparse
-    
+
     parser = argparse.ArgumentParser(description="AWSO-5 Architecture Validation")
     parser.add_argument("--vpc-id", required=True, help="VPC ID to validate")
     parser.add_argument("--profile", help="AWS profile name")
     parser.add_argument("--region", default="us-east-1", help="AWS region")
-    
+
     args = parser.parse_args()
-    
+
     result = validate_vpc_architecture_cli(args.vpc_id, args.profile, args.region)
-    
-    print_success(f"Architecture validation completed with {result.overall_compliance_score:.1f}% compliance score")
+
+    print_success(f"Architecture validation completed with {result.overall_compliance_score:.1f}% compliance score")