cloud-infra-detector（云红外探测器）

Cloud Infrastructure Detector Skill

Purpose

Detect cloud providers, PaaS platforms, and serverless services from IP attribution, DNS records, HTTP headers, and other signals.

Input

Raw signals from Phase 2:

• ip_signals - Cloud provider IP range matches, ASN data
• dns_signals - CNAME delegations, TXT verification records
• http_signals - Cloud-specific headers
• tls_signals - Certificate issuers (ACM, GCP, etc.)
• repository_signals - IaC files, CI/CD configs

Technology Categories

Major Cloud Providers

PaaS Platforms

Serverless Platforms

Container Orchestration

Managed Services

Detection Logic

def detect_cloud_infrastructure(signals):
    results = []

    # IP-based Cloud Detection
    for ip_data in signals.ip_signals:
        if ip_data.cloud_provider:
            results.append({
                "name": ip_data.cloud_provider,
                "category": "Cloud Provider",
                "signals": [
                    {
                        "type": "ip_attribution",
                        "value": f"IP {ip_data.ip} in {ip_data.cloud_provider} range",
                        "region": ip_data.region
                    }
                ],
                "total_weight": 40
            })

    # CNAME-based PaaS Detection
    for cname in signals.dns_signals.cname_records:
        for paas in PAAS_PATTERNS:
            if paas.pattern in cname.target:
                results.append({
                    "name": paas.name,
                    "category": "PaaS",
                    "signals": [
                        {
                            "type": "dns_cname",
                            "value": f"CNAME → {cname.target}"
                        }
                    ],
                    "implies": paas.implies,
                    "total_weight": paas.weight
                })

    # Header-based Detection
    for header, value in signals.http_signals.headers.items():
        # AWS Headers
        if header.startswith('X-Amz-'):
            add_if_not_exists(results, "AWS", "Cloud Provider", {
                "type": "http_header",
                "value": f"{header}: {value}"
            }, 35)

        # Vercel Header
        if header == 'X-Vercel-Id':
            add_if_not_exists(results, "Vercel", "PaaS", {
                "type": "http_header",
                "value": f"X-Vercel-Id present"
            }, 40)

        # Netlify Headers
        if header.startswith('X-NF-'):
            add_if_not_exists(results, "Netlify", "PaaS", {
                "type": "http_header",
                "value": f"{header} present"
            }, 35)

    # Certificate Issuer Detection
    for cert in signals.tls_signals:
        if "Amazon" in cert.issuer:
            add_if_not_exists(results, "AWS Certificate Manager", "Managed Service", {
                "type": "certificate",
                "value": f"Issuer: {cert.issuer}"
            }, 35)
            add_if_not_exists(results, "AWS", "Cloud Provider", {
                "type": "certificate",
                "value": "ACM certificate implies AWS infrastructure"
            }, 30)

        if "Google Trust Services" in cert.issuer:
            add_if_not_exists(results, "Google Cloud", "Cloud Provider", {
                "type": "certificate",
                "value": "GTS certificate implies GCP infrastructure"
            }, 30)

    # Repository IaC Detection
    if signals.repository_signals:
        for file in signals.repository_signals.files:
            if "terraform" in file.lower():
                # Parse terraform for provider
                results.append({
                    "name": "Terraform",
                    "category": "IaC",
                    "signals": [{"type": "repository", "value": f"File: {file}"}],
                    "total_weight": 25
                })

            if "cloudformation" in file.lower() or file.endswith('.cfn.yml'):
                results.append({
                    "name": "AWS CloudFormation",
                    "category": "IaC",
                    "implies": ["AWS"],
                    "signals": [{"type": "repository", "value": f"File: {file}"}],
                    "total_weight": 30
                })

    return results

Output

{
  "skill": "cloud_infra_detector",
  "results": {
    "technologies": [
      {
        "name": "AWS",
        "category": "Cloud Provider",
        "signals": [
          {
            "type": "ip_attribution",
            "value": "IP 52.84.123.45 in AWS CloudFront range",
            "region": "us-east-1",
            "weight": 40
          },
          {
            "type": "certificate",
            "value": "ACM certificate detected",
            "weight": 30
          }
        ],
        "total_weight": 70,
        "services_detected": ["CloudFront", "ACM"]
      },
      {
        "name": "Vercel",
        "category": "PaaS",
        "signals": [
          {
            "type": "dns_cname",
            "value": "CNAME → cname.vercel-dns.com",
            "weight": 35
          },
          {
            "type": "http_header",
            "value": "X-Vercel-Id header present",
            "weight": 40
          }
        ],
        "total_weight": 75,
        "implies": ["AWS"]
      },
      {
        "name": "Terraform",
        "category": "IaC",
        "signals": [
          {
            "type": "repository",
            "value": "terraform/ directory found",
            "weight": 25
          }
        ],
        "total_weight": 25
      }
    ],
    "infrastructure_summary": {
      "primary_cloud": "AWS",
      "hosting_platform": "Vercel",
      "cdn": "Vercel Edge Network (AWS-backed)",
      "container_orchestration": null,
      "infrastructure_as_code": "Terraform"
    },
    "regions_detected": ["us-east-1", "us-west-2"]
  }
}

Cloud-Specific Signals

AWS

Headers: X-Amz-Cf-Id, X-Amz-Request-Id, X-Amz-Bucket-Region
CNAME: cloudfront.net, elasticbeanstalk.com, s3.amazonaws.com
ASN: AS16509, AS14618
Certificate: Amazon, AWS

Google Cloud

Headers: X-Goog-*, X-GUploader-UploadID
CNAME: googleapis.com, appspot.com, run.app
ASN: AS15169, AS396982
Certificate: Google Trust Services

Microsoft Azure

Headers: X-Azure-*, X-MS-*
CNAME: azurewebsites.net, azure-api.net, blob.core.windows.net
ASN: AS8075
Certificate: Microsoft

Error Handling

• Multiple cloud providers: Report all with confidence
• PaaS on cloud: Report both PaaS and underlying cloud
• Uncertain attribution: Lower confidence, flag for correlation