runbooks cfat¶
Assess | 5 commands | Management. Auto-generated from Click registry on 2026-04-01.
QA/QC: 5/5 commands PASSED (v1.3.17)
L1 --help: 5/5 | L2 params: PASS | L4 cross-validation: N/A
First time? Set up your AWS profiles
Before running any command, configure your AWS SSO profiles. See the Single Account or Multi-Account Landing Zone tabs below for copy-paste setup blocks.
AWS Profile Configuration¶
All runbooks commands support these common options for AWS authentication:
| Option | Scope | When to Use |
|---|---|---|
--profile PROFILE |
Single account | Developer/operator targeting one AWS account |
--all-profiles |
All accounts (Landing Zone) | Platform team — discovers across all SSO profiles |
--region REGION |
Override region | Non-default region (default: ap-southeast-2) |
--dry-run |
Safe mode | Analysis only, no mutations (recommended for first run) |
--output-dir DIR |
Output path | Directory for generated reports (default: output/) |
--format FORMAT |
Output format | table, json, csv, markdown (varies by command) |
Copy and configure:
# =============================================================
# AWS Single Account Configuration
# =============================================================
export AWS_REGION="ap-southeast-2"
export AWS_PROFILE="your-account-profile"
# Authenticate via SSO
aws sso login --profile $AWS_PROFILE
# Verify
aws sts get-caller-identity --profile $AWS_PROFILE
# Run any command
runbooks finops dashboard --profile $AWS_PROFILE
Copy and configure all 4 environment variables:
# =============================================================
# AWS Multi-Account Landing Zone Configuration
# =============================================================
export AWS_REGION="ap-southeast-2"
## Single account (default fallback)
export AWS_PROFILE="your-default-profile"
## FinOps/Billing profile (READ-ONLY access to Cost Explorer)
export AWS_BILLING_PROFILE="your-billing-readonly-profile"
## Management account profile (Organizations, Control Tower)
export AWS_MANAGEMENT_PROFILE="your-management-readonly-profile"
## Centralized Operations account profile (for shared resources)
export AWS_OPERATIONS_PROFILE="your-operations-readonly-profile"
# =============================================================
# Authenticate all profiles
# =============================================================
aws sso login --profile $AWS_BILLING_PROFILE
aws sso login --profile $AWS_MANAGEMENT_PROFILE
aws sso login --profile $AWS_OPERATIONS_PROFILE
# =============================================================
# Verify connectivity
# =============================================================
aws sts get-caller-identity --profile $AWS_BILLING_PROFILE
aws sts get-caller-identity --profile $AWS_MANAGEMENT_PROFILE
# =============================================================
# Run org-wide commands
# =============================================================
runbooks inventory collect --all-profiles --region $AWS_REGION
runbooks finops dashboard --all-profiles --format table
Environment Variables Reference¶
| Variable | Required | Purpose |
|---|---|---|
AWS_REGION |
Yes | Target AWS region (default: ap-southeast-2) |
AWS_PROFILE |
Yes | Default profile when --profile is omitted |
AWS_BILLING_PROFILE |
LZ only | Cost Explorer data enrichment |
AWS_MANAGEMENT_PROFILE |
LZ only | Organizations metadata enrichment |
AWS_OPERATIONS_PROFILE |
LZ only | Centralized Operations shared resources |
RUNBOOKS_TEST_MODE |
No | Set to 1 for offline/mock mode (no AWS calls) |
Commands¶
| Command | Description | Params | API Type |
|---|---|---|---|
assess |
Comprehensive Well-Architected Framework assessment with universal profile support. | 11 | read-only |
report |
Generate comprehensive Well-Architected assessment reports with universal profile support. | 9 | read-only |
review |
Structured architecture review with stakeholder collaboration and universal profile support. | 10 | read-only |
status |
Show CFAT status and configuration. | 0 | read-only |
version |
Show CFAT version information. | 0 | read-only |
Quick Start by Role¶
Cloud Foundations Assessment Tool for Well-Architected reviews.
| Task | Command |
|---|---|
| Assessment report | runbooks cfat report --profile $AWS_PROFILE |
| Task | Command |
|---|---|
| Full assessment | runbooks cfat assess --profile $AWS_PROFILE |
| Architecture review | runbooks cfat review --profile $AWS_PROFILE |
| Task | Command |
|---|---|
| Quick status | runbooks cfat status |
Command Details¶
runbooks cfat assess¶
Comprehensive Well-Architected Framework assessment with universal profile support.
All Parameters (11)
| Parameter | Type | Default | Description |
|---|---|---|---|
--profile |
STRING | - | AWS profile for single-account operations. |
--region |
STRING | ap-southeast-2 |
AWS region override (default: ap-southeast-2) |
--dry-run |
BOOL | True |
Safe analysis mode - no resource modifications (enterprise default) |
--pillar |
CHOICE(operational-excellence | security | reliability |
--all-pillars |
BOOL | False |
Assess all Well-Architected pillars |
--workload-name |
STRING | - | Name of the workload being assessed |
--assessment-depth |
CHOICE(basic | comprehensive | enterprise) |
--export-format |
CHOICE(json | csv | |
--all |
BOOL | False |
Use all available AWS profiles for multi-account Well-Architected assessment |
--verbose/-v |
BOOL | False |
Show detailed logs |
--format |
CHOICE(compact | table | json) |
runbooks cfat report¶
Generate comprehensive Well-Architected assessment reports with universal profile support.
All Parameters (9)
| Parameter | Type | Default | Description |
|---|---|---|---|
--profile |
STRING | - | AWS profile for single-account operations. |
--region |
STRING | ap-southeast-2 |
AWS region override (default: ap-southeast-2) |
--dry-run |
BOOL | True |
Safe analysis mode - no resource modifications (enterprise default) |
--format |
CHOICE(pdf | html | markdown |
--executive-summary |
BOOL | False |
Generate executive summary |
--include-remediation |
BOOL | True |
Include remediation roadmap |
--output-dir |
STRING | ./cfat_reports |
Output directory |
--workload-filter |
STRING | - | Filter reports by workload name |
--all |
BOOL | False |
Use all available AWS profiles for multi-account Well-Architected reporting |
runbooks cfat review¶
Structured architecture review with stakeholder collaboration and universal profile support.
All Parameters (10)
| Parameter | Type | Default | Description |
|---|---|---|---|
--profile |
STRING | - | AWS profile for single-account operations. |
--region |
STRING | ap-southeast-2 |
AWS region override (default: ap-southeast-2) |
--dry-run |
BOOL | True |
Safe analysis mode - no resource modifications (enterprise default) |
--workload-name |
STRING | - | Name of the workload for review |
--review-type |
CHOICE(initial | milestone | continuous) |
--stakeholders |
STRING | - | Stakeholder names/emails for review |
--include-recommendations |
BOOL | True |
Include remediation recommendations |
--all |
BOOL | False |
Use all available AWS profiles for multi-account architecture review |
--verbose/-v |
BOOL | False |
Show detailed logs |
--format |
CHOICE(compact | table | json) |
runbooks cfat status¶
Show CFAT status and configuration.
runbooks cfat version¶
Show CFAT version information.