|
|
@@ -0,0 +1,56 @@
|
|
|
+locals {
|
|
|
+ # If you want to use any of the variables in _this_ file, you have to load them here.
|
|
|
+ # However, they will all be available as inputs to the module loaded in terraform.source
|
|
|
+ # below.
|
|
|
+
|
|
|
+ # e.g. inherited variables:
|
|
|
+ environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
|
|
|
+ partition_vars = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
|
|
|
+ region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
|
|
|
+ account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
|
|
|
+ global_vars = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
|
|
|
+}
|
|
|
+
|
|
|
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
|
|
|
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
|
|
|
+terraform {
|
|
|
+ # Double slash is intentional and required to show root of modules
|
|
|
+ source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//thirdparty/terraform-aws-kinesis-firehose-splunk?ref=v1.10.8"
|
|
|
+}
|
|
|
+
|
|
|
+dependency "c2_account_standards" {
|
|
|
+ config_path = local.account_vars.locals.c2_account_standards_path
|
|
|
+}
|
|
|
+
|
|
|
+# Include all settings from the root terragrunt.hcl file
|
|
|
+include {
|
|
|
+ path = find_in_parent_folders()
|
|
|
+}
|
|
|
+
|
|
|
+# These are the variables we have to pass in to use the module specified in the terragrunt source above
|
|
|
+inputs = {
|
|
|
+ # All of the inputs from the inherited hcl files are available automatically
|
|
|
+ # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
|
|
|
+ # will be more flexible if you specify particular input values.
|
|
|
+ tags = {
|
|
|
+ Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
|
|
|
+ }
|
|
|
+ cloudtrail_key_arn = dependency.c2_account_standards.outputs.cloudtrail_logging_bucket.kms_key_id
|
|
|
+
|
|
|
+ region = local.region_vars.locals.aws_region
|
|
|
+ arn_cloudwatch_logs_to_ship = "arn:${local.partition_vars.locals.aws_partition}:logs:${local.region_vars.locals.aws_region}::log-group:/aws/lambda/portal_data_sync"
|
|
|
+ name_cloudwatch_logs_to_ship = "/aws/lambda/portal_data_sync"
|
|
|
+ hec_token = local.account_vars.locals.portal_data_sync_hec_token
|
|
|
+ hec_url = "https://${local.environment_vars.locals.hec_pub_ack}:8088"
|
|
|
+ firehose_name = "portal_data_sync_to_splunk"
|
|
|
+ cloudwatch_log_retention = 14 # keep kinesis logs this long
|
|
|
+ log_stream_name = "SplunkDelivery_PortalDataSync"
|
|
|
+ s3_bucket_name = "kinesis-flowlogs-${local.account_vars.locals.aws_account_id}-${local.region_vars.locals.aws_region}"
|
|
|
+ cloudwatch_to_firehose_trust_iam_role_name = "CloudWatchToSplunkFirehoseTrust_PortalDataSync"
|
|
|
+ kinesis_firehose_lambda_role_name = "KinesisFirehoseToLambaRole_PortalDataSync"
|
|
|
+ lambda_function_name = "kinesis-firehose-transform-PortalDataSync"
|
|
|
+ kinesis_firehose_iam_policy_name = "KinesisFirehose-Policy-PortalDataSync"
|
|
|
+ kinesis_firehose_role_name = "KinesisFirehoseRole-PortalDataSync"
|
|
|
+ lambda_iam_policy_name = "Kinesis-Firehose-to-Splunk-Policy-PortalDataSync"
|
|
|
+ cloudwatch_to_fh_access_policy_name = "KinesisCloudWatchToFirehosePolicy_PortalDataSync"
|
|
|
+}
|
Frederick Damstra