xdr-terraform-live/test/aws-us-gov/mdr-test-modelclient/account.hcl

# Set account-wide variables. These are automatically pulled in to configure the remote state bucket in the root
# terragrunt.hcl configuration.
locals {
  account_name   = "afs-mdr-test-modelclient-gov"
  account_alias  = "afs-mdr-test-modelclient-gov"
  aws_account_id = "701341250728"
  instance_termination_protection = false # set to true for production!
  splunk_prefix = "modelclient"

  splunk_data_sources = [
  ]
  splunk_legacy_cidr = [ ] # Should not be needed for new customers
  splunk_asg_sizes   = [ 1, 1, 1 ] # How many indexers in each site
  
  account_tags = {
    "Client": local.splunk_prefix
  } 
  c2_account_standards_path = "../../mdr-test-c2/005-account-standards-c2" # Subsitute with test or prod

  # For CIDR assignment, see https://github.mdr.defpoint.com/mdr-engineering/msoc-infrastructure/wiki/IP-Address-Allocation
  vpc_info = { 
    "vpc-splunk" = {
       "name" = "vpc-splunk",
       "purpose" = "Splunk Systems (modelclient)", # Substitute with Customer Name
       "cidr" = "10.22.0.0/22",
       "tgw_attached" = true
    }
  } 

  # Qualys Connector
  qualys_connector_externalid = "LATER" # Needs to come from the qualys console

  # End of TODO

  # Splunk instance sizes can be customized
  # TODO: Set these appropriately in the skeleton for prod
  instance_types = {
    "splunk-cm"      = "t3a.small",  # legacy: t2.small
    "splunk-indexer" = "m5d.xlarge", # legacy: t2.small, but whats the point if we don't have instance storage.
    "splunk-hf"      = "t3a.small", # legacy: t2.medium
    "splunk-sh"      = "t3a.small", # legacy: ? not sure
    "splunk-cust-sh" = "t3a.small", # legacy: ? not sure
  }

  # Splunk Volume Sizes are probably fine at defaults
  splunk_volume_sizes = {
    "cluster_master" = {
      "swap": 8,  # minimum: 8
      "/": 20,    # minimum: 10
      "/home": 4, # minimum: 4
      "/var": 15, # minimum: 15
      "/var/tmp": 4, # minimum: 4
      "/var/log": 8, # minimum: 8
      "/var/log/audit": 8, # minimum: 8
      "/tmp": 4,  # minimum: 4
      "/opt/splunk": 30, # No minimum; not in base image
    },
    "customer_searchhead" = {
      "swap": 8,  # minimum: 8
      "/": 20,    # minimum: 10
      "/home": 4, # minimum: 4
      "/var": 15, # minimum: 15
      "/var/tmp": 4, # minimum: 4
      "/var/log": 8, # minimum: 8
      "/var/log/audit": 8, # minimum: 8
      "/tmp": 4,  # minimum: 4
      "/opt/splunk": 60, # No minimum; not in base image
    },
    "indexer" = {
      "swap": 8,  # minimum: 8
      "/": 20,    # minimum: 20
      "/home": 4, # minimum: 4
      "/var": 15, # minimum: 15
      "/var/tmp": 4, # minimum: 4
      "/var/log": 8, # minimum: 8
      "/var/log/audit": 8, # minimum: 8
      "/tmp": 4,  # minimum: 4
      "/opt/splunk": 30, # No minimum; not in base image
    },
    "searchhead" = {
      "swap": 8,  # minimum: 8
      "/": 20,    # minimum: 10
      "/home": 4, # minimum: 4
      "/var": 15, # minimum: 15
      "/var/tmp": 4, # minimum: 4
      "/var/log": 8, # minimum: 8
      "/var/log/audit": 8, # minimum: 8
      "/tmp": 4,  # minimum: 4
      "/opt/splunk": 30, # No minimum; not in base image
    },
    "heavy_forwarder" = {
      "swap": 8,  # minimum: 8
      "/": 20,    # minimum: 10
      "/home": 4, # minimum: 4
      "/var": 15, # minimum: 15
      "/var/tmp": 4, # minimum: 4
      "/var/log": 8, # minimum: 8
      "/var/log/audit": 8, # minimum: 8
      "/tmp": 4,  # minimum: 4
      "/opt/splunk": 30, # No minimum; not in base image
    },
  }
}