runbooks vpc¶

7 commands for VPC analysis, network topology, and VPCE cleanup optimization.

AWS Profile Configuration¶

All runbooks commands support these common options for AWS authentication:

Option	Scope	When to Use
`--profile PROFILE`	Single account	Developer/operator targeting one AWS account
`--all-profiles`	All accounts (Landing Zone)	Platform team — discovers across all SSO profiles
`--region REGION`	Override region	Non-default region (default: `ap-southeast-2`)
`--dry-run`	Safe mode	Analysis only, no mutations (recommended for first run)
`--output-dir DIR`	Output path	Directory for generated reports (default: `output/`)
`--format FORMAT`	Output format	`table`, `json`, `csv`, `markdown` (varies by command)

Single Account Setup¶

Copy and configure:

# =============================================================
# AWS Single Account Configuration
# =============================================================
export AWS_REGION="ap-southeast-2"
export AWS_PROFILE="your-account-profile"

# Authenticate via SSO
aws sso login --profile $AWS_PROFILE

# Verify
aws sts get-caller-identity --profile $AWS_PROFILE

# Run any command
runbooks finops dashboard --profile $AWS_PROFILE

Multi-Account Landing Zone Setup¶

Copy and configure all 4 environment variables:

# =============================================================
# AWS Multi-Account Landing Zone Configuration
# =============================================================
export AWS_REGION="ap-southeast-2"

## Single account (default fallback)
export AWS_PROFILE="your-default-profile"

## FinOps/Billing profile (READ-ONLY access to Cost Explorer)
export AWS_BILLING_PROFILE="your-billing-readonly-profile"

## Management account profile (Organizations, Control Tower)
export AWS_MANAGEMENT_PROFILE="your-management-readonly-profile"

## Centralized Operations account profile (for shared resources)
export AWS_OPERATIONS_PROFILE="your-operations-readonly-profile"

# =============================================================
# Authenticate all profiles
# =============================================================
aws sso login --profile $AWS_BILLING_PROFILE
aws sso login --profile $AWS_MANAGEMENT_PROFILE
aws sso login --profile $AWS_OPERATIONS_PROFILE

# =============================================================
# Verify connectivity
# =============================================================
aws sts get-caller-identity --profile $AWS_BILLING_PROFILE
aws sts get-caller-identity --profile $AWS_MANAGEMENT_PROFILE

# =============================================================
# Run org-wide commands
# =============================================================
runbooks inventory collect --all-profiles --region $AWS_REGION
runbooks finops dashboard --all-profiles --format table

Environment Variables Reference¶

Variable	Required	Purpose
`AWS_REGION`	Yes	Target AWS region (default: `ap-southeast-2`)
`AWS_PROFILE`	Yes	Default profile when `--profile` is omitted
`AWS_BILLING_PROFILE`	LZ only	Cost Explorer data enrichment
`AWS_MANAGEMENT_PROFILE`	LZ only	Organizations metadata enrichment
`AWS_OPERATIONS_PROFILE`	LZ only	Centralized Operations shared resources
`RUNBOOKS_TEST_MODE`	No	Set to `1` for offline/mock mode (no AWS calls)

Commands¶

Command	Description	API Type
`analyze`	Comprehensive VPC analysis	read-only
`analyze-endpoint-activity`	VPC endpoint activity analysis	read-only
`discover-firewall-bypass`	Network Firewall bypass detection	read-only
`nat-gateway`	NAT Gateway cost and usage analysis	read-only
`network-discover`	Network topology discovery	read-only
`topology`	VPC topology visualization	read-only
`vpce-cleanup`	VPC endpoint cleanup candidates and savings	write

Usage Examples¶

Single AccountMulti-Account Landing Zone

# VPC topology for one account
runbooks vpc topology \
  --profile $AWS_PROFILE \
  --region $AWS_REGION

# NAT Gateway cost analysis
runbooks vpc nat-gateway \
  --profile $AWS_PROFILE

# VPCE cleanup analysis (dry-run)
runbooks vpc vpce-cleanup \
  --profile $AWS_PROFILE \
  --dry-run

# Cross-account VPC analysis
runbooks vpc analyze --all \
  --output-dir output/vpc/

# Network Firewall bypass detection across org
runbooks vpc discover-firewall-bypass \
  --management-profile $AWS_MANAGEMENT_PROFILE \
  --operational-profile $AWS_OPERATIONS_PROFILE \
  --billing-profile $AWS_BILLING_PROFILE

# Org-wide NAT Gateway optimization
runbooks vpc nat-gateway --all

Write Commands

vpce-cleanup can modify VPC endpoints. Always use --dry-run first:

runbooks vpc vpce-cleanup --profile my-account --dry-run