runbooks inventory¶
Auto-generated from
runbooks inventory --helpon 2026-05-21. Source of truth: runbooks PyPI package v1.3.22
Runbooks Inventory - Multi-account AWS resource discovery
📋 Command Categories (40 operations across 9 categories):
1️⃣ Discovery: resource-explorer (88 AWS resource types)
2️⃣ Organizations: org-*, accounts-* (multi-account management)
3️⃣ VPC/Network: vpc-*, nat-*, elb-* (network architecture)
4️⃣ CloudFormation: cfn-*, stack-* (IaC drift detection)
5️⃣ Activity/Scoring: enrich-*, score-* (decommission analysis)
6️⃣ Security/Compliance: security-*, audit-*, check-*
7️⃣ Workflows: workflow-*, pipeline-* (automated pipelines)
8️⃣ Validation: validate-*, verify-* (MCP cross-validation)
9️⃣ Utilities: export-*, clean-*, show-* (helper commands)
Inventory Commands (59 commands)
├── 🔍 Multi-Account Discovery (6 commands)
│ └── Command Description
│ collect Multi-account resource
│ discovery via Resource Explorer
│ resource-explorer Discover resources by friendly
│ alias (88 types)
│ resource-types List all 88 supported resource
│ types
│ discover-rds RDS database discovery
│ discover-lambda Lambda function discovery
│ collect-containers Container discovery (ECS
│ clusters, tasks, services)
├── 🏢 Organizations (14 commands)
│ └── Command Description
│ list-org-accounts List AWS accounts in
│ organization
│ list-org-users List IAM users across
│ organization
│ draw-org Visualize organization
│ hierarchy
│ check-landingzone Validate Landing Zone
│ configuration
│ check-controltower Validate Control Tower setup
│ find-lz-versions Discover Landing Zone versions
│ collect-ram-shares Discover AWS RAM shares
│ list-enabled-services List Organizations-enabled
│ service principals
│ list-delegated-administrators List Organizations delegated
│ administrators
│ list-org-policies List Organizations policies
│ (SCP/Tag/Backup/AI)
│ list-resource-groups List AWS Resource Groups in
│ region
│ list-app-registry-applications List Service Catalog
│ AppRegistry applications
│ describe-delegated-admin-policy Describe Organization
│ resource-based (trust) policy
│ org-governance-report AWS Organizations governance
│ dashboard — accounts, SCPs,
│ services, delegated admins
├── 🔄 Enrichment Layers (5 commands)
│ └── Command Description
│ enrich-accounts Add Organizations metadata
│ enrich-costs Add cost data from Cost
│ Explorer
│ enrich-activity Add CloudTrail activity signals
│ enrich-ec2 EC2-specific enrichment
│ score-decommission Score decommission candidates
│ (E1-E7/W1-W6)
├── 🌐 VPC & Network (via `inventory vpc` subgroup) (7 commands)
│ └── Command Description
│ vpc flow-logs VPC Flow Logs discovery and
│ analysis
│ vpc nat-traffic NAT Gateway traffic analysis
│ vpc security-groups Security group validation
│ vpc validate VPC architecture assessment
│ vpc dependencies Cross-VPC dependency analysis
│ list-elbs Load balancer discovery
│ (ELB/ALB/NLB)
│ list-enis Network interface discovery
│ (ENI)
├── ☁️ CloudFormation (6 commands)
│ └── Command Description
│ find-cfn-drift CloudFormation drift detection
│ find-cfn-orphaned-stacks Orphaned stack discovery
│ list-cfn-stacks List CloudFormation stacks
│ list-cfn-stacksets List CloudFormation StackSets
│ find-cfn-stackset-drift StackSet drift detection
│ recover-cfn-stack-ids Recover CloudFormation stack
│ IDs
├── 🔒 Security & Compliance (6 commands)
│ └── Command Description
│ check-cloudtrail-compliance CloudTrail compliance
│ validation
│ list-guardduty-detectors GuardDuty detector discovery
│ tag-coverage Tag coverage analysis
│ drift-detection Comprehensive drift detection
│ ssm-status SSM Agent status for EC2
│ instance (ssm_agent_status,
│ ssm_ping_status)
│ ebs-health EBS volume health and
│ attachment status for EC2
│ instance
├── 📡 Other Services (3 commands)
│ └── Command Description
│ list-sns-topics SNS topic discovery
│ collect-messaging Messaging resources (SQS
│ queues, SNS topics)
│ collect-analytics Analytics resources (Athena,
│ Glue databases/tables)
├── 🚀 Workflows (3 commands)
│ └── Command Description
│ workflow-single-account 4-layer pipeline (single
│ account)
│ workflow-multi-account 5-layer pipeline (multi-account
│ LZ)
│ pipeline-summary Display pipeline execution
│ summary
├── ✅ Validation (3 commands)
│ └── Command Description
│ validate-mcp MCP cross-validation (≥99.5%
│ accuracy)
│ validate-costs Cost data accuracy validation
│ cross-validate 4-way cross-validation
│ (MCP/CLI/Console/AWS)
├── 🛠️ Utilities (1 commands)
│ └── Command Description
│ clean-outputs Clean output directory
└── 🔍 Resource Investigation (5 commands)
└── Command Description
ec2-investigate 6-phase EC2 host investigation
(security, network, compliance)
rds-investigate 6-phase RDS instance
investigation (security,
network, compliance)
s3-investigate 6-phase S3 bucket investigation
(public access, encryption,
compliance)
workspaces-investigate 6-phase WorkSpaces
investigation (cost, security,
compliance)
vpc-investigate 6-phase VPC/TGW investigation
(topology, security, flow logs)
💡 Common Workflows:
Quick discovery: runbooks inventory resource-explorer --resource-type ec2
--profile $AWS_PROFILE
With cost data: Add --enrich-costs --billing-profile BILLING
Full 5-layer: runbooks inventory workflow-multi-account
🔑 Profile Requirements:
CENTRALISED_OPS: Resource Explorer aggregator access
BILLING: Cost Explorer API access (enrich-costs)
MANAGEMENT: Organizations API access (enrich-accounts)