Cloud Imports

netbobr can import native cloud firewall configurations from 6 platforms, extracting flows and analyzing them against all 6 compliance frameworks. Both the browser app (drag-and-drop) and the CLI support cloud format imports with automatic format detection.

Format Comparison

Match rates are measured against a 400-rule CSV baseline covering wide-open rules, risky ports, container ports, database ports, ICMP, port ranges, protocol variety, CIDR ranges, and edge cases.

* The Terraform HCL figure is low because its test fixture is a small sample (45 flows) of the 400-row baseline, not because rules are dropped. The CLI and the browser use the same parsers and give the same figures for every format.

How It Works

1. Export your firewall configuration from your cloud provider using the provider's CLI or console
2. Upload the exported file by dragging it onto the browser import area, or pipe it to the CLI
3. Analyze -- netbobr automatically detects the format, extracts individual flows, and evaluates each flow against all 6 compliance frameworks (PCI-DSS, CIS Controls, NIST 800-53, NIS2, DORA, MITRE ATT&CK)

Each parsed flow receives a risk score (0-100), compliance findings, and zone assignments just like manually entered flows.

Browser vs CLI

Both the browser and CLI use automatic format detection -- you do not need to specify the format manually (though the CLI accepts --cloud-format for explicit selection).

The browser and the CLI use the same parsers, so a file produces the same flows and warnings in both. The Terraform HCL parser reads .tf files with regular expressions and handles common resource blocks. For modules, for_each, dynamic blocks or computed values, prefer terraform show -json (plan JSON). In the browser, PDF export is available for single manually entered flows only, not for batch imports.

In the browser, cloud imports are subject to the same 500-row limit as CSV imports. Cloud configs can expand into many flows (each rule multiplies source prefixes × destination prefixes × port ranges); flows beyond the first 500 are ignored and the upload status reports how many were dropped.

When flows match between CLI and browser, risk scores, risk levels, and verdicts are identical (100% field accuracy).

Placeholders and Warnings

Cloud rules often name things that are not IP ranges: security groups, tags, service accounts, pod selectors, Terraform variables. netbobr never drops such a rule silently. It handles it in one of two ways and always shows a warning in the import banner (and in the CLI output):

• Substituted with 0.0.0.0/0. The side that cannot be resolved becomes the 0.0.0.0/0 placeholder, so the rule is still analysed, conservatively. The warning names the rule, the side, and what was substituted, for example TF aws_security_group_rule.ssh: source Terraform reference var.office_cidr cannot be resolved to CIDR -- substituted 0.0.0.0/0.
• Skipped. Rules that would become misleading are skipped with the reason: AWS security group references and self, IPv6 ranges, VPC prefix lists, unsupported protocols (ESP, AH, GRE, SCTP, ICMPv6), named Kubernetes ports, and disabled GCP rules.

The "own" side of a rule is the set of instances the rule protects: AWS security group members, the pods selected by a Kubernetes policy, GCP target instances. It can never be resolved, so it is always the placeholder. Because this applies to every rule, netbobr reports it once per file per provider, with counts and up to 5 names, for example 24 AWS security groups: member instances cannot be resolved to CIDR -- substituted 0.0.0.0/0 as the destination of 223 inbound flows and the source of 137 outbound flows (web-servers-1, …).

Deny rules (GCP, Terraform GCP, Azure) are not evaluated: netbobr analyses allow rules one by one and does not model rule priority. Each file gets one summary warning, for example 3 deny rules were not evaluated.

When a file produces no flows (for example only deny rules, only security group references, or default-deny Kubernetes policies), the import says so and lists the warnings instead of reporting a format error.

Platform Pages

• AWS Security Groups -- aws ec2 describe-security-groups / describe-security-group-rules output
• Azure NSG -- az network nsg show / az network nsg list output
• GCP Firewall Rules -- gcloud compute firewall-rules list output
• Terraform Plan JSON -- terraform show -json output
• Terraform HCL -- .tf files
• Kubernetes NetworkPolicy -- kubectl get networkpolicy -o yaml (or -o json) output

See Also

• CSV Import -- bulk-validate up to 500 firewall rules from a CSV file
• GitHub Actions -- integrate cloud format analysis into CI/CD pipelines