# Set common variables for the environment. This is automatically pulled in in the root terragrunt.hcl configuration to # feed forward to the child modules. locals { environment = "test" transit_gateway_account_name = "mdr-test-c2" # Which account has the transit gateway environment_tags = { "Schedule" = "MSOC", Environment = local.environment } proxy = "proxy.pvt.xdrtest.accenturefederalcyber.com" proxy_ip = "10.96.101.188" salt_master = "salt-master.pvt.xdrtest.accenturefederalcyber.com" salt_master_ip = "10.96.101.161" hec = "moose-hec.xdrtest.accenturefederalcyber.com" hec_pub = "moose-hec.xdrtest.accenturefederalcyber.com" hec_pub_ack = "moose-hec-ack.xdrtest.accenturefederalcyber.com" # When there are multiples, put govcloud first, then commercial, and alternate if there are more than 2. # Put any standalone IPs at the end. cidr_map = { # See infrastructure_notes/Architecture_Notes.md and https://github.mdr.defpoint.com/mdr-engineering/msoc-infrastructure/wiki/IP-Address-Allocation for more information "vpc-splunk" = [ "10.20.16.0/22", # Splunk -- **MOOSE** "10.96.100.0/22", # legacy moose subnet ], "vpc-access" = [ "10.20.20.0/22", # VPN, bastions (if any), etc. "10.96.101.218/32", # legacy bastion "10.96.101.249/32", # legacy openvpn ], "vpc-public" = [ "10.20.24.0/22", # Public sites (github, ghe-backup, jira, ...) "10.96.101.193/32", # legacy jira ], "vpc-scanners" = [ "10.20.12.0/22" ], # Qualys, etc. "vpc-system-services" = [ "10.16.0.0/22", # Internal services such as dns, mailrelay, etc. "10.20.0.0/22", "10.96.101.43/32", # legacy sensu "10.96.101.161/32", # legacy salt master "10.96.101.188/32", # legacy proxy "10.96.101.160/32", # legacy repo "10.96.1.160/32", # legacy smtp ], "vpc-private-services" = [ "10.20.28.0/22", # Private Services - fm-shared-search, qcompliance, phantom, etc. "10.96.101.221/32", # Phantom - legacy account production "10.96.0.0/16", # the whole legacy infra VPC, so the sync lambda can sync (this is temp) # (wes made me do it honest) ], # "old" mappings before architecture planning... we should eliminate these. "bastions" = [ "10.96.101.218/32", "10.20.20.0/22" ], # vpc-access in mdr-test-c2-gov "vpns" = [ "10.96.101.249/32", "10.20.20.0/22" ], # vpc-access in mdr-test-c2-gov "scanners" = [ "10.20.12.0/22" ], # vpc-qualys "dns" = [ "10.20.0.0/22", "10.16.0.0/22" ], # vpc-system-services in commercial nad gov "monitoring" = [ "10.96.101.43/32", "10.20.0.0/22" ], # legacy sensu, and vpc-system-services in gov "salt" = [ "10.96.101.161/32", "10.20.0.0/22" ], # legacy salt-master, and vpc-system-services in gov "web" = [ "10.96.101.188/32", "10.96.101.160/32", "10.20.0.0/22" ], # legacy proxy/repo, and vpc-system-services in gov "moose" = [ "10.96.0.0/16", "10.20.16.0/22" ], # legacy vpc and vpc-splunk in gov } legacy_account = "527700175026" c2_accounts = { "aws-us-gov" = "738800754746" # mdr-test-c2-gov "aws" = "816914342178" # mdr-test-c2 } dns_servers = [ "10.20.2.64", "10.16.2.123", ] inbound_resolver_endpoints = [ "10.20.0.119", "10.20.0.211", ] dns_info = { "private" = { zone = "pvt.xdrtest.accenturefederalcyber.com", zone_id = "Z08514662ZGG8BM81TKD5" } "reverse" = { zone = "10.in-addr.arpa" zone_id = "Z08479312XJFUS20YJUJO" } "public" = { zone = "xdrtest.accenturefederalcyber.com" zone_id = "Z01677392W0QM639KU2KC" }, "legacy_private" = { zone = "msoc.defpoint.local" zone_id = "Z39OIGEKXXGJZ2" }, "legacy_public" = { zone = "mdr-test.defpoint.com" zone_id = "Z3E22S3CIP0UCO" }, "legacy_public_internal" = { # Weird name, but this is the 'private' copy of the public domain zone = "mdr-test.defpoint.com" zone_id = "Z13C1OOJMG0BJ7" }, } aws_flowlogs_hec_token = "4a2cacb2-fea1-4328-8f25-9bef26333e91" # Legacy DNS dns_private = { "id" = "Z39OIGEKXXGJZ2" "name" = "msoc.defpoint.local" } dns_private2 = { "id" = "Z13C1OOJMG0BJ7", #zone 2 "name" = "mdr-test.defpoint.com" } dns_public = { "id" = "Z3E22S3CIP0UCO", "name" = "mdr-test.defpoint.com" } # Provide some legacy DNS entries so that systems we build # don't have to be rebuilt when we migrate the supporting systems. # Idea here is just to build entries for those systems we need during # the transition. # # When you migrate one of the systems below: # 1) Remove the entry from this list. # 2) Reapply the legacy-mdr-*/026-legacy-dns-entries module. # 3) Create a new entry in the module with which you're creating the new instance. legacy_private_dns = { #"moose-splunk-cm" = "10.96.101.87", #"moose-splunk-hf" = "10.96.101.75", #"moose-splunk-sh" = "10.96.101.154", # needed for xdr-inventory #"clu" = "10.96.101.122", #"fm-shared-search" = "10.96.1.39", #"ghe-backup" = "10.96.101.71", #"mailrelay" = "10.96.1.160", #"openvpn" = "10.96.101.249", #"phantom" = "10.96.101.186", #"proxy" = "10.96.101.188", #"reposerver" = "10.96.101.160", #"sensu" = "10.96.101.43", #"splunk-mc" = "10.96.1.133", #"vault-1" = "10.96.1.38", #"vault-2" = "10.96.2.63", #"vault-3" = "10.96.3.88", "salt-master-legacy" = "10.96.101.161", } legacy_private_cname_dns = { #"iratemoses" = "internal-iratemoses-435580743.us-gov-east-1.elb.amazonaws.com", } # not many public entries, as the use of saml negates their usefulness legacy_public_dns = { #"proxy" = "18.214.39.158", #"reposerver" = "34.202.16.40", "salt-master-legacy" = "18.233.43.236", #"sensu" = "34.235.81.176" } # cnames only legacy_public_cname_dns = { #"iratemoses" = "moose-legacy-hec-1138113830.us-gov-east-1.elb.amazonaws.com", "portal" = "portal-alb-test-868493124.us-east-1.elb.amazonaws.com" } }