老旧系统
CloudHound 可迁移早至 FreeBSD 2.2.8、Debian 2.2、RHEL 2.1 和 Windows Server 2003 的版本，并为每个版本选择其可运行的 EC2 硬件。
Three panels left to right: the question asked through the MCP, the plan it returns, and the Terraform it writes. Best for showing that one prompt produces a reviewed rule set.
| Port | Source | Seen |
|---|---|---|
| 8443 | sg-billing-web Moves in this wave | 14 of 14 days |
| 8443 | 10.20.8.14/32 10.20.8.15/32 Reporting, wave 2 | 12 of 14 days |
| 5701 | Self Cache cluster | 14 of 14 days |
| 3389 | 10.20.1.0/24 Jump hosts, staying | 9 of 14 days |
| 443 | 10.30.0.0/16 Office users, 214 clients | 14 of 14 days |
| 9090 | Not opened Listening, never used | 0 of 14 days |
resource "aws_security_group" "billing_app" { name = "sg-billing-app" vpc_id = var.vpc_id } resource "aws_vpc_security_group_ingress_rule" "app_from_web" { security_group_id = aws_security_group.billing_app.id referenced_security_group_id = aws_security_group.billing_web.id from_port = 8443 to_port = 8443 ip_protocol = "tcp" } # temporary: reporting moves in wave 2 resource "aws_vpc_security_group_ingress_rule" "app_from_rpt" { cidr_ipv4 = "10.20.8.14/32" ...
A network view. Source networks on the left, the new security group in the middle, the target VPC on the right. Solid lines are permanent rules. Dashed amber lines are temporary and point at servers that have not moved yet.
A wave timeline. Each wave shows the rules it adds and the temporary address rules it replaces with group references, so the rule count falls as the estate moves.
The generated code is the hero. Temporary rules are highlighted and carry a tag naming the wave that removes them, and the side panel explains each warning. The same plan is also available as CloudFormation or AWS CLI.
# generated by CloudHound from 14 days of traffic, 6 servers resource "aws_vpc_security_group_ingress_rule" "app_self_5701" { security_group_id = aws_security_group.billing_app.id referenced_security_group_id = aws_security_group.billing_app.id from_port = 5701 to_port = 5701 } resource "aws_vpc_security_group_ingress_rule" "app_users_443" { security_group_id = aws_security_group.billing_app.id prefix_list_id = aws_ec2_managed_prefix_list.office.id from_port = 443 to_port = 443 } resource "aws_vpc_security_group_ingress_rule" "app_rpt_8443" { security_group_id = aws_security_group.billing_app.id cidr_ipv4 = "10.20.8.14/32" from_port = 8443 to_port = 8443 tags = { cloudhound-temporary = "wave-2" replace-with = "sg-reporting" } }