Altsysteme
CloudHound migriert Versionen bis zurück zu FreeBSD 2.2.8, Debian 2.2, RHEL 2.1 und Windows Server 2003 und wählt für jede die EC2-Hardware, auf der sie laufen kann.
Three panels left to right: the question asked through the MCP, the plan it returns, and the Terraform it writes. Best for showing that one prompt produces a reviewed rule set.
| Port | Source | Seen |
|---|---|---|
| 8443 | sg-billing-web Moves in this wave | 14 of 14 days |
| 8443 | 10.20.8.14/32 10.20.8.15/32 Reporting, wave 2 | 12 of 14 days |
| 5701 | Self Cache cluster | 14 of 14 days |
| 3389 | 10.20.1.0/24 Jump hosts, staying | 9 of 14 days |
| 443 | 10.30.0.0/16 Office users, 214 clients | 14 of 14 days |
| 9090 | Not opened Listening, never used | 0 of 14 days |
resource "aws_security_group" "billing_app" { name = "sg-billing-app" vpc_id = var.vpc_id } resource "aws_vpc_security_group_ingress_rule" "app_from_web" { security_group_id = aws_security_group.billing_app.id referenced_security_group_id = aws_security_group.billing_web.id from_port = 8443 to_port = 8443 ip_protocol = "tcp" } # temporary: reporting moves in wave 2 resource "aws_vpc_security_group_ingress_rule" "app_from_rpt" { cidr_ipv4 = "10.20.8.14/32" ...
A network view. Source networks on the left, the new security group in the middle, the target VPC on the right. Solid lines are permanent rules. Dashed amber lines are temporary and point at servers that have not moved yet.
A wave timeline. Each wave shows the rules it adds and the temporary address rules it replaces with group references, so the rule count falls as the estate moves.
The generated code is the hero. Temporary rules are highlighted and carry a tag naming the wave that removes them, and the side panel explains each warning. The same plan is also available as CloudFormation or AWS CLI.
# generated by CloudHound from 14 days of traffic, 6 servers resource "aws_vpc_security_group_ingress_rule" "app_self_5701" { security_group_id = aws_security_group.billing_app.id referenced_security_group_id = aws_security_group.billing_app.id from_port = 5701 to_port = 5701 } resource "aws_vpc_security_group_ingress_rule" "app_users_443" { security_group_id = aws_security_group.billing_app.id prefix_list_id = aws_ec2_managed_prefix_list.office.id from_port = 443 to_port = 443 } resource "aws_vpc_security_group_ingress_rule" "app_rpt_8443" { security_group_id = aws_security_group.billing_app.id cidr_ipv4 = "10.20.8.14/32" from_port = 8443 to_port = 8443 tags = { cloudhound-temporary = "wave-2" replace-with = "sg-reporting" } }