Creates splunk master node and indexer cluster in test

test/aws-us-gov/mdr-test-c2/150-splunk-cluster-master/terragrunt.hcl

@@ -0,0 +1,43 @@
+locals {
+  # If you want to use any of the variables in _this_ file, you have to load them here.
+  # However, they will all be available as inputs to the module loaded in terraform.source
+  # below.
+  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
+  partition_vars = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
+  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
+  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
+  global_vars = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
+}
+
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  # Double slash is intentional and required to show root of modules
+  source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//base/splunk_servers/cluster_master?ref=v1.0.0"
+}
+
+dependency "vpc" {
+  config_path = "../010-vpc-splunk"
+}
+
+# Include all settings from the root terragrunt.hcl file
+include {
+  path = find_in_parent_folders()
+}
+
+# These are the variables we have to pass in to use the module specified in the terragrunt source above
+inputs = {
+  # All of the inputs from the inherited hcl files are available automatically
+  # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
+  # will be more flexible if you specify particular input values.
+  tags = {
+    Purpose = "Splunk Cluster Master"
+    Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
+  }
+  prefix = local.account_vars.locals.splunk_prefix
+  instance_type = local.account_vars.locals.instance_types["splunk-cm"]
+  vpc_id = dependency.vpc.outputs.vpc_id
+  vpc_cidr = local.account_vars.locals.vpc_info["vpc-splunk"]["cidr"]
+  azs = dependency.vpc.outputs.azs
+  subnets = dependency.vpc.outputs.private_subnets
+}

test/aws-us-gov/mdr-test-c2/160-splunk-indexer-cluster/README.md

@@ -0,0 +1,7 @@
+# Creates the Indexer Cluster
+
+* 3x indexer ASGs
+* NLB for splunk data
+* ALB for hec without ack
+* ELB classic for HEC with ack
+* Security Groups for all of the above

test/aws-us-gov/mdr-test-c2/160-splunk-indexer-cluster/terragrunt.hcl

@@ -0,0 +1,45 @@
+locals {
+  # If you want to use any of the variables in _this_ file, you have to load them here.
+  # However, they will all be available as inputs to the module loaded in terraform.source
+  # below.
+  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
+  partition_vars = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
+  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
+  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
+  global_vars = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
+}
+
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  # Double slash is intentional and required to show root of modules
+  source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//base/splunk_servers/indexer_cluster?ref=v1.0.0"
+}
+
+dependency "vpc" {
+  config_path = "../010-vpc-splunk"
+}
+
+# Include all settings from the root terragrunt.hcl file
+include {
+  path = find_in_parent_folders()
+}
+
+# These are the variables we have to pass in to use the module specified in the terragrunt source above
+inputs = {
+  # All of the inputs from the inherited hcl files are available automatically
+  # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
+  # will be more flexible if you specify particular input values.
+  tags = {
+    Purpose = "Splunk Indexer Cluster"
+    Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
+  }
+  prefix = local.account_vars.locals.splunk_prefix
+  instance_type = local.account_vars.locals.instance_types["splunk-indexer"]
+  vpc_id = dependency.vpc.outputs.vpc_id
+  vpc_cidr = local.account_vars.locals.vpc_info["vpc-splunk"]["cidr"]
+  azs = dependency.vpc.outputs.azs
+  volume_sizes = local.account_vars.locals.splunk_volume_sizes
+  private_subnets = dependency.vpc.outputs.private_subnets
+  public_subnets  = dependency.vpc.outputs.public_subnets
+}

test/aws-us-gov/mdr-test-c2/account.hcl

@@ -5,6 +5,33 @@ locals {
   account_alias  = "afs-mdr-test-c2-gov"
   aws_account_id = "738800754746"
   instance_termination_protection = false # set to true for production!
+  splunk_prefix = "moose2"
+
+  # Additional sources that are allowed to send data, such as Customer LCPs, Azure, etc.
+  splunk_data_sources = [
+    "170.248.172.0/23", # ?
+    "20.190.250.137/32", # ?
+    "52.232.227.197/32", # ?
+    "52.185.64.173/32", # ?
+    "52.242.225.98/32", # ?
+    "52.177.84.83/32", # ?
+    "199.16.64.3/32", #?
+    "99.56.213.129/32", # Fred Damstra's Home IP - For testing
+  ]
+  splunk_legacy_cidr = [ # Allow splunk ports to/from here, too
+    "10.80.100.0/22",
+  ]
+  splunk_asg_sizes = [ 1, 1, 1 ] # How many?
+  splunk_volume_sizes = {
+    "swap": 8,  # minimum: 8
+    "/": 10,    # minimum: 10
+    "/home": 4, # minimum: 4
+    "/var": 15, # minimum: 15
+    "/var/tmp": 4, # minimum: 4
+    "/var/log": 8, # minimum: 8
+    "/var/log/audit": 8, # minimum: 8
+    "/tmp": 4  # minimum: 4
+  }
   
   account_tags = { } 
   c2_account_standards_path = "../../mdr-test-c2/005-account-standards-c2"
@@ -61,6 +88,14 @@ locals {
     },
   }
 
+  instance_types = {
+    "splunk-cm"      = "t3a.small",  # legacy: t2.small
+    "splunk-indexer" = "i3en.large", # legacy: t2.small, but whats the point if we don't have instance storage.
+    "splunk-hf"      = "t3a.small", # legacy: t2.medium
+    "splunk-sh"      = "t3a.small", # legacy: ? not sure
+  }
+
+  # TODO: The instance types below should be moved to the instance_type map above
   # DNS Resolver
   resolver_instance_type = "t3a.micro"
   resolver_instance_key_name = "fdamstra"