|
|
@@ -10,7 +10,7 @@ locals {
|
|
|
}
|
|
|
|
|
|
proxy = "proxy.pvt.xdrtest.accenturefederalcyber.com"
|
|
|
- proxy_ip = "10.96.101.188"
|
|
|
+ proxy_ip = "10.20.2.22"
|
|
|
salt_master = "salt-master.pvt.xdrtest.accenturefederalcyber.com"
|
|
|
salt_master_ip = "10.20.2.32"
|
|
|
hec = "moose-hec.xdrtest.accenturefederalcyber.com"
|
|
|
@@ -29,40 +29,27 @@ locals {
|
|
|
cidr_map = {
|
|
|
# See infrastructure_notes/Architecture_Notes.md and https://github.mdr.defpoint.com/mdr-engineering/msoc-infrastructure/wiki/IP-Address-Allocation for more information
|
|
|
"vpc-splunk" = [ "10.20.16.0/22", # Splunk -- **MOOSE**
|
|
|
- "10.96.100.0/22", # legacy moose subnet
|
|
|
],
|
|
|
"vpc-access" = [ "10.20.20.0/22", # VPN, bastions (if any), etc.
|
|
|
- "10.96.101.218/32", # legacy bastion
|
|
|
- "10.96.101.249/32", # legacy openvpn
|
|
|
],
|
|
|
"vpc-public" = [ "10.20.24.0/22", # Public sites (github, ghe-backup, jira, ...)
|
|
|
- "10.96.101.193/32", # legacy jira
|
|
|
- "10.96.101.217/32", # legacy github
|
|
|
],
|
|
|
"vpc-scanners" = [ "10.20.12.0/22" ], # Qualys, etc.
|
|
|
"vpc-system-services" = [ "10.16.0.0/22", # Internal services such as dns, mailrelay, etc.
|
|
|
"10.20.0.0/22",
|
|
|
- "10.96.101.43/32", # legacy sensu
|
|
|
- "10.96.101.161/32", # legacy salt master
|
|
|
- "10.96.101.188/32", # legacy proxy
|
|
|
- "10.96.101.160/32", # legacy repo
|
|
|
- "10.96.1.160/32", # legacy smtp
|
|
|
],
|
|
|
"vpc-private-services" = [ "10.20.28.0/22", # Private Services - fm-shared-search, qcompliance, phantom, etc.
|
|
|
- "10.96.101.221/32", # Phantom - legacy account production
|
|
|
- "10.96.0.0/16", # the whole legacy infra VPC, so the sync lambda can sync (this is temp)
|
|
|
- # (wes made me do it honest)
|
|
|
],
|
|
|
|
|
|
# "old" mappings before architecture planning... we should eliminate these.
|
|
|
- "bastions" = [ "10.96.101.218/32", "10.20.20.0/22" ], # vpc-access in mdr-test-c2-gov
|
|
|
- "vpns" = [ "10.96.101.249/32", "10.20.20.0/22" ], # vpc-access in mdr-test-c2-gov
|
|
|
+ "bastions" = [ "10.20.20.0/22" ], # vpc-access in mdr-test-c2-gov
|
|
|
+ "vpns" = [ "10.20.20.0/22" ], # vpc-access in mdr-test-c2-gov
|
|
|
"scanners" = [ "10.20.12.0/22" ], # vpc-qualys
|
|
|
"dns" = [ "10.20.0.0/22", "10.16.0.0/22" ], # vpc-system-services in commercial nad gov
|
|
|
- "monitoring" = [ "10.96.101.43/32", "10.20.0.0/22" ], # legacy sensu, and vpc-system-services in gov
|
|
|
- "salt" = [ "10.96.101.161/32", "10.20.0.0/22" ], # legacy salt-master, and vpc-system-services in gov
|
|
|
- "web" = [ "10.96.101.188/32", "10.96.101.160/32", "10.20.0.0/22" ], # legacy proxy/repo, and vpc-system-services in gov
|
|
|
- "moose" = [ "10.96.0.0/16", "10.20.16.0/22" ], # legacy vpc and vpc-splunk in gov
|
|
|
+ "monitoring" = [ "10.20.0.0/22" ], # legacy sensu, and vpc-system-services in gov
|
|
|
+ "salt" = [ "10.20.0.0/22" ], # legacy salt-master, and vpc-system-services in gov
|
|
|
+ "web" = [ "10.20.0.0/22" ], # legacy proxy/repo, and vpc-system-services in gov
|
|
|
+ "moose" = [ "10.20.16.0/22" ], # legacy vpc and vpc-splunk in gov
|
|
|
}
|
|
|
|
|
|
legacy_account = "527700175026"
|
|
|
@@ -122,48 +109,4 @@ locals {
|
|
|
"id" = "Z3E22S3CIP0UCO",
|
|
|
"name" = "mdr-test.defpoint.com"
|
|
|
}
|
|
|
-
|
|
|
- # Provide some legacy DNS entries so that systems we build
|
|
|
- # don't have to be rebuilt when we migrate the supporting systems.
|
|
|
- # Idea here is just to build entries for those systems we need during
|
|
|
- # the transition.
|
|
|
- #
|
|
|
- # When you migrate one of the systems below:
|
|
|
- # 1) Remove the entry from this list.
|
|
|
- # 2) Reapply the legacy-mdr-*/026-legacy-dns-entries module.
|
|
|
- # 3) Create a new entry in the module with which you're creating the new instance.
|
|
|
- legacy_private_dns = {
|
|
|
- #"moose-splunk-cm" = "10.96.101.87",
|
|
|
- #"moose-splunk-hf" = "10.96.101.75",
|
|
|
- #"moose-splunk-sh" = "10.96.101.154", # needed for xdr-inventory
|
|
|
- #"clu" = "10.96.101.122",
|
|
|
- #"fm-shared-search" = "10.96.1.39",
|
|
|
- #"ghe-backup" = "10.96.101.71",
|
|
|
- #"mailrelay" = "10.96.1.160",
|
|
|
- #"openvpn" = "10.96.101.249",
|
|
|
- #"phantom" = "10.96.101.186",
|
|
|
- #"proxy" = "10.96.101.188",
|
|
|
- #"reposerver" = "10.96.101.160",
|
|
|
- #"sensu" = "10.96.101.43",
|
|
|
- #"splunk-mc" = "10.96.1.133",
|
|
|
- #"vault-1" = "10.96.1.38",
|
|
|
- #"vault-2" = "10.96.2.63",
|
|
|
- #"vault-3" = "10.96.3.88",
|
|
|
- "salt-master-legacy" = "10.96.101.161",
|
|
|
- }
|
|
|
- legacy_private_cname_dns = {
|
|
|
- #"iratemoses" = "internal-iratemoses-435580743.us-gov-east-1.elb.amazonaws.com",
|
|
|
- }
|
|
|
- # not many public entries, as the use of saml negates their usefulness
|
|
|
- legacy_public_dns = {
|
|
|
- #"proxy" = "18.214.39.158",
|
|
|
- #"reposerver" = "34.202.16.40",
|
|
|
- "salt-master-legacy" = "18.233.43.236",
|
|
|
- #"sensu" = "34.235.81.176"
|
|
|
- }
|
|
|
- # cnames only
|
|
|
- legacy_public_cname_dns = {
|
|
|
- #"iratemoses" = "moose-legacy-hec-1138113830.us-gov-east-1.elb.amazonaws.com",
|
|
|
- #"portal" = "portal-alb-test-868493124.us-east-1.elb.amazonaws.com"
|
|
|
- }
|
|
|
}
|
Frederick Damstra