Merge pull request #442 from mdr-engineering/feature/ftd_MSOCI-1795_FRTIB_Cust_Searchhead

Adds FRTIB Customer Search Head

prod/aws-us-gov/mdr-prod-frtib/190-splunk-customer-searchhead/terragrunt.hcl

@@ -0,0 +1,46 @@
+locals {
+  # If you want to use any of the variables in _this_ file, you have to load them here.
+  # However, they will all be available as inputs to the module loaded in terraform.source
+  # below.
+  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
+  partition_vars = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
+  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
+  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
+  global_vars = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
+}
+
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  # Double slash is intentional and required to show root of modules
+  source = "git@github.xdr.accenturefederalcyber.com:mdr-engineering/xdr-terraform-modules.git//base/splunk_servers/customer_searchhead?ref=v3.0.5"
+}
+
+dependency "vpc" {
+  config_path = "../010-vpc-splunk"
+}
+
+# Include all settings from the root terragrunt.hcl file
+include {
+  path = find_in_parent_folders()
+}
+
+# These are the variables we have to pass in to use the module specified in the terragrunt source above
+inputs = {
+  # All of the inputs from the inherited hcl files are available automatically
+  # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
+  # will be more flexible if you specify particular input values.
+  tags = {
+    Purpose = "Splunk Customer-Accessible Searchhead"
+    Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
+  }
+  prefix = local.account_vars.locals.splunk_prefix
+  instance_type = local.account_vars.locals.instance_types["splunk-sh"]
+  vpc_id = dependency.vpc.outputs.vpc_id
+  vpc_cidr = local.account_vars.locals.vpc_info["vpc-splunk"]["cidr"]
+  azs = dependency.vpc.outputs.azs
+  private_subnets = dependency.vpc.outputs.private_subnets
+  public_subnets = dependency.vpc.outputs.public_subnets
+}
+terraform_version_constraint = "= 1.0.7"
+terragrunt_version_constraint = "= 0.32.3"

prod/aws-us-gov/mdr-prod-frtib/account.hcl

@@ -50,6 +50,7 @@ locals {
     "splunk-indexer" = "i3en.3xlarge", # legacy: t2.small, but whats the point if we don't have instance storage.
     "splunk-hf"      = "m5a.xlarge", # legacy: t2.medium
     "splunk-sh"      = "m5a.4xlarge", # legacy: ? not sure
+    "splunk-cust-sh" = "m5a.xlarge",
   }
 
   # Splunk Volume Sizes are probably fine at defaults
@@ -87,6 +88,17 @@ locals {
       "/tmp": 4,  # minimum: 4
       "/opt/splunk": 30, # No minimum; not in base image
     },
+    "customer_searchhead" = {
+      "swap": 8,  # minimum: 8
+      "/": 10,    # minimum: 10
+      "/home": 4, # minimum: 4
+      "/var": 15, # minimum: 15
+      "/var/tmp": 4, # minimum: 4
+      "/var/log": 8, # minimum: 8
+      "/var/log/audit": 8, # minimum: 8
+      "/tmp": 4,  # minimum: 4
+      "/opt/splunk": 60, # No minimum; not in base image
+    },
     "heavy_forwarder" = {
       "swap": 8,  # minimum: 8
       "/": 10,    # minimum: 10

test/aws-us-gov/mdr-test-modelclient/190-splunk-customer-searchhead/terragrunt.hcl

@@ -35,7 +35,7 @@ inputs = {
     Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
   }
   prefix = local.account_vars.locals.splunk_prefix
-  instance_type = local.account_vars.locals.instance_types["splunk-sh"]
+  instance_type = local.account_vars.locals.instance_types["splunk-cust-sh"]
   vpc_id = dependency.vpc.outputs.vpc_id
   vpc_cidr = local.account_vars.locals.vpc_info["vpc-splunk"]["cidr"]
   azs = dependency.vpc.outputs.azs

test/aws-us-gov/mdr-test-modelclient/account.hcl

@@ -40,6 +40,7 @@ locals {
     "splunk-indexer" = "m5d.xlarge", # legacy: t2.small, but whats the point if we don't have instance storage.
     "splunk-hf"      = "t3a.small", # legacy: t2.medium
     "splunk-sh"      = "t3a.small", # legacy: ? not sure
+    "splunk-cust-sh" = "t3a.small", # legacy: ? not sure
   }
 
   # Splunk Volume Sizes are probably fine at defaults