runbooks operate

9 commands for EC2, S3, VPC, and CloudFormation write operations with universal profile support.

AWS Profile Configuration

All runbooks commands support these common options for AWS authentication:

Option	Scope	When to Use
--profile PROFILE	Single account	Developer/operator targeting one AWS account
--all-profiles	All accounts (Landing Zone)	Platform team — discovers across all SSO profiles
--region REGION	Override region	Non-default region (default: ap-southeast-2)
--dry-run	Safe mode	Analysis only, no mutations (recommended for first run)
--output-dir DIR	Output path	Directory for generated reports (default: output/)
--format FORMAT	Output format	table, json, csv, markdown (varies by command)

Single Account Setup

Copy and configure:

# =============================================================
# AWS Single Account Configuration
# =============================================================
export AWS_REGION="ap-southeast-2"
export AWS_PROFILE="your-account-profile"

# Authenticate via SSO
aws sso login --profile $AWS_PROFILE

# Verify
aws sts get-caller-identity --profile $AWS_PROFILE

# Run any command
runbooks finops dashboard --profile $AWS_PROFILE

Multi-Account Landing Zone Setup

Copy and configure all 4 environment variables:

# =============================================================
# AWS Multi-Account Landing Zone Configuration
# =============================================================
export AWS_REGION="ap-southeast-2"

## Single account (default fallback)
export AWS_PROFILE="your-default-profile"

## FinOps/Billing profile (READ-ONLY access to Cost Explorer)
export AWS_BILLING_PROFILE="your-billing-readonly-profile"

## Management account profile (Organizations, Control Tower)
export AWS_MANAGEMENT_PROFILE="your-management-readonly-profile"

## Centralized Operations account profile (for shared resources)
export AWS_OPERATIONS_PROFILE="your-operations-readonly-profile"

# =============================================================
# Authenticate all profiles
# =============================================================
aws sso login --profile $AWS_BILLING_PROFILE
aws sso login --profile $AWS_MANAGEMENT_PROFILE
aws sso login --profile $AWS_OPERATIONS_PROFILE

# =============================================================
# Verify connectivity
# =============================================================
aws sts get-caller-identity --profile $AWS_BILLING_PROFILE
aws sts get-caller-identity --profile $AWS_MANAGEMENT_PROFILE

# =============================================================
# Run org-wide commands
# =============================================================
runbooks inventory collect --all-profiles --region $AWS_REGION
runbooks finops dashboard --all-profiles --format table

Environment Variables Reference

Variable	Required	Purpose
AWS_REGION	Yes	Target AWS region (default: ap-southeast-2)
AWS_PROFILE	Yes	Default profile when --profile is omitted
AWS_BILLING_PROFILE	LZ only	Cost Explorer data enrichment
AWS_MANAGEMENT_PROFILE	LZ only	Organizations metadata enrichment
AWS_OPERATIONS_PROFILE	LZ only	Centralized Operations shared resources
RUNBOOKS_TEST_MODE	No	Set to 1 for offline/mock mode (no AWS calls)

Commands

Command	Description	API Type
cloudformation	CloudFormation stack operations	write
cloudformation deploy	Deploy CloudFormation stack	write
ec2	EC2 instance and resource operations	write
ec2 start	Start EC2 instances	write
ec2 stop	Stop EC2 instances	write
s3	S3 bucket and object operations	write
s3 create-bucket	Create S3 bucket with enterprise config	write
vpc	VPC and networking operations	write
vpc create-vpc	Create VPC with enterprise config	write

Usage Examples

Write Operations

All operate commands modify AWS resources. Use --dry-run before executing.

Single AccountMulti-Account Landing Zone

# Stop EC2 instances (dry-run first)
runbooks operate ec2 stop \
  --profile $AWS_PROFILE \
  --instance-ids i-0123456789abcdef0 \
  --dry-run

# Create S3 bucket with enterprise defaults
runbooks operate s3 create-bucket \
  --profile $AWS_PROFILE \
  --bucket-name my-bucket \
  --region $AWS_REGION

# Deploy CloudFormation stack
runbooks operate cloudformation deploy \
  --profile $AWS_OPERATIONS_PROFILE \
  --stack-name my-stack \
  --template-file template.yaml

# Create VPC with enterprise config
runbooks operate vpc create-vpc \
  --profile $AWS_OPERATIONS_PROFILE \
  --cidr 10.0.0.0/16