레거시 시스템
CloudHound는 FreeBSD 2.2.8, Debian 2.2, RHEL 2.1, Windows Server 2003까지 거슬러 올라가는 릴리스를 마이그레이션하며, 각 릴리스가 실행될 수 있는 EC2 하드웨어를 선택합니다.
Three panels left to right: the question asked through the MCP, the plan it returns, and the Terraform it writes. Best for showing that one prompt produces a reviewed rule set.
| Port | Source | Seen |
|---|---|---|
| 8443 | sg-billing-web Moves in this wave | 14 of 14 days |
| 8443 | 10.20.8.14/32 10.20.8.15/32 Reporting, wave 2 | 12 of 14 days |
| 5701 | Self Cache cluster | 14 of 14 days |
| 3389 | 10.20.1.0/24 Jump hosts, staying | 9 of 14 days |
| 443 | 10.30.0.0/16 Office users, 214 clients | 14 of 14 days |
| 9090 | Not opened Listening, never used | 0 of 14 days |
resource "aws_security_group" "billing_app" { name = "sg-billing-app" vpc_id = var.vpc_id } resource "aws_vpc_security_group_ingress_rule" "app_from_web" { security_group_id = aws_security_group.billing_app.id referenced_security_group_id = aws_security_group.billing_web.id from_port = 8443 to_port = 8443 ip_protocol = "tcp" } # temporary: reporting moves in wave 2 resource "aws_vpc_security_group_ingress_rule" "app_from_rpt" { cidr_ipv4 = "10.20.8.14/32" ...
A network view. Source networks on the left, the new security group in the middle, the target VPC on the right. Solid lines are permanent rules. Dashed amber lines are temporary and point at servers that have not moved yet.
A wave timeline. Each wave shows the rules it adds and the temporary address rules it replaces with group references, so the rule count falls as the estate moves.
The generated code is the hero. Temporary rules are highlighted and carry a tag naming the wave that removes them, and the side panel explains each warning. The same plan is also available as CloudFormation or AWS CLI.
# generated by CloudHound from 14 days of traffic, 6 servers resource "aws_vpc_security_group_ingress_rule" "app_self_5701" { security_group_id = aws_security_group.billing_app.id referenced_security_group_id = aws_security_group.billing_app.id from_port = 5701 to_port = 5701 } resource "aws_vpc_security_group_ingress_rule" "app_users_443" { security_group_id = aws_security_group.billing_app.id prefix_list_id = aws_ec2_managed_prefix_list.office.id from_port = 443 to_port = 443 } resource "aws_vpc_security_group_ingress_rule" "app_rpt_8443" { security_group_id = aws_security_group.billing_app.id cidr_ipv4 = "10.20.8.14/32" from_port = 8443 to_port = 8443 tags = { cloudhound-temporary = "wave-2" replace-with = "sg-reporting" } }