Sets up the AWS Kinesis Firehose to send WAF logs to Splunk HEC

common/env.hcl

@@ -8,6 +8,13 @@ locals {
     Environment = local.environment
   }
 
+  proxy = "proxy.msoc.defpoint.local"
+  proxy_ip = "10.80.101.166"
+  salt_master = "salt-master.msoc.defpoint.local"
+  salt_master_ip = "10.80.101.170"
+  hec = "iratemoses.pvt.xdr.accenturefederalcyber.com"
+  hec_pub = "iratemoses.mdr.defpoint.com"
+
   legacy_account = "477548533976"
   c2_accounts = {
     "aws-us-gov" = "721817724804" # mdr-prod-c2-gov

prod/aws/legacy-mdr-prod/045-kinesis-firehose-waf-logs/terragrunt.hcl

@@ -0,0 +1,39 @@
+locals {
+  # If you want to use any of the variables in _this_ file, you have to load them here.
+  # However, they will all be available as inputs to the module loaded in terraform.source
+  # below.
+
+  # e.g. inherited variables:
+  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
+  partition_vars = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
+  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
+  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
+  global_vars = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
+}
+
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  # Double slash is intentional and required to show root of modules
+  source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//base/kinesis_firehose_waf_logs?ref=v0.7.6"
+}
+
+dependency "c2_account_standards" {
+  config_path = local.account_vars.locals.c2_account_standards_path
+}
+
+# Include all settings from the root terragrunt.hcl file
+include {
+  path = find_in_parent_folders()
+}
+
+# These are the variables we have to pass in to use the module specified in the terragrunt source above
+inputs = {
+  # All of the inputs from the inherited hcl files are available automatically
+  # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
+  # will be more flexible if you specify particular input values.
+  tags = {
+    Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
+  }
+  cloudtrail_key_arn = dependency.c2_account_standards.outputs.cloudtrail_logging_bucket.kms_key_id
+}

prod/env.hcl

@@ -12,6 +12,8 @@ locals {
   proxy_ip = "10.80.101.166"
   salt_master = "salt-master.msoc.defpoint.local"
   salt_master_ip = "10.80.101.170"
+  hec = "iratemoses.pvt.xdr.accenturefederalcyber.com"
+  hec_pub = "iratemoses.mdr.defpoint.com"
 
   # Todo: Add CIDRs from new environment as they are assigned
   # When there are multiples, put govcloud first, then commercial, and alternate if there are more than 2.

test/aws/legacy-mdr-test/045-kinesis-firehose-waf-logs/terragrunt.hcl

@@ -0,0 +1,39 @@
+locals {
+  # If you want to use any of the variables in _this_ file, you have to load them here.
+  # However, they will all be available as inputs to the module loaded in terraform.source
+  # below.
+
+  # e.g. inherited variables:
+  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
+  partition_vars = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
+  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
+  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
+  global_vars = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
+}
+
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  # Double slash is intentional and required to show root of modules
+  source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//base/kinesis_firehose_waf_logs?ref=v0.7.6"
+}
+
+dependency "c2_account_standards" {
+  config_path = local.account_vars.locals.c2_account_standards_path
+}
+
+# Include all settings from the root terragrunt.hcl file
+include {
+  path = find_in_parent_folders()
+}
+
+# These are the variables we have to pass in to use the module specified in the terragrunt source above
+inputs = {
+  # All of the inputs from the inherited hcl files are available automatically
+  # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
+  # will be more flexible if you specify particular input values.
+  tags = {
+    Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
+  }
+  cloudtrail_key_arn = dependency.c2_account_standards.outputs.cloudtrail_logging_bucket.kms_key_id
+}

test/aws/legacy-mdr-test/account.hcl

@@ -16,6 +16,8 @@ locals {
   create_test_instance = false
   test_instance_key_name = "TODO" # They with which to provision the test instance
 
+  aws_waf_logs_hec_token = "B1945FC4-CA44-4B8C-BFFA-60A9BF841E4D"
+
   # Legacy accounts have some extra key users
   is_legacy = true
   extra_ebs_key_admins = [ 

test/env.hcl

@@ -12,6 +12,8 @@ locals {
   proxy_ip = "10.96.101.188"
   salt_master = "salt-master.msoc.defpoint.local"
   salt_master_ip = "10.96.101.161"
+  hec = "iratemoses.pvt.xdrtest.accenturefederalcyber.com"
+  hec_pub = "iratemoses.mdr-test.defpoint.com"
 
   # Todo: Add CIDRs from new environment as they are assigned
   # When there are multiples, put govcloud first, then commercial, and alternate if there are more than 2.