xdr-terraform-live/prod/aws-us-gov/mdr-prod-frtib/account.hcl

# Set account-wide variables. These are automatically pulled in to configure the remote state bucket in the root
# terragrunt.hcl configuration.
locals {
  # TODO put the right values here
  account_name                    = "mdr-prod-frtib"
  account_alias                   = "mdr-prod-frtib"
  aws_account_id                  = "237704155425"
  instance_termination_protection = true # set to true for production!
  splunk_prefix                   = "frtib"
  splunk_private_hec              = false # True if the customer needs a private HTTP Event Collector such as for ALSI

  splunk_data_sources = [
    "52.61.113.202/32", # TODO: Add customer's public IP addresses
    "54.205.60.17/32",  # 2021-05-04 From John Conrad john.conrad.2@alight.com
    "52.206.203.98/32",
    "34.233.188.131/32",
    "15.200.226.57/32",  # 2021-07-12 From "Nguyen, Brian A." <brian.a.nguyen@accenturefederal.com>
    "34.214.247.125/32", # 2022-01-20 From John Conrad john.conrad.2@alight.com
    "44.235.174.214/32",
    "52.89.203.9/32",
    "3.221.245.113/32",  # FRTIB Chaos us-east-1
    "34.237.100.242/32", # FRTIB Chaos us-east-1
    "35.172.75.107/32",  # FRTIB Chaos us-east-1
    "54.164.205.89/32",  # FRTIB Chaos us-east-1
    "54.209.105.32/32",  # FRTIB Chaos us-east-1
    "54.224.69.136/32",  # FRTIB Chaos us-east-1

  ]
  splunk_legacy_cidr = []        # Should not be needed for new customers
  splunk_asg_sizes   = [1, 1, 1] # How many indexers in each site


  account_tags = {
    "Client" : local.splunk_prefix,
  }
  c2_account_standards_path = "../../mdr-prod-c2/005-account-standards-c2" # TODO: Subsitute with test or prod

  # For CIDR assignment, see https://github.mdr.defpoint.com/mdr-engineering/msoc-infrastructure/wiki/IP-Address-Allocation
  vpc_info = {
    "vpc-splunk" = {
      "name"         = "vpc-splunk",
      "purpose"      = "Splunk Systems (FRTIB)", # TODO: Substitute with Customer Name
      "cidr"         = "10.42.36.0/22",
      "tgw_attached" = true
    }
  }

  # Qualys Connector - See https://github.mdr.defpoint.com/mdr-engineering/msoc-infrastructure/wiki/Qualys
  qualys_connector_externalid = "1619382305452" # Needs to come from the qualys console

  # End of TODO

  # Splunk instance sizes can be customized
  # TODO: Set these appropriately in the skeleton for prod
  instance_types = {
    "alsi-master"    = "t3a.small",
    "alsi-worker"    = "t3a.small",
    "splunk-cm"      = "m5a.xlarge",   # legacy: t2.small
    "splunk-indexer" = "i3en.3xlarge", # legacy: t2.small, but whats the point if we don't have instance storage.
    "splunk-hf"      = "m5a.xlarge",   # legacy: t2.medium
    "splunk-sh"      = "m5a.4xlarge",  # legacy: ? not sure
    "splunk-cust-sh" = "m5a.xlarge",
  }

  # Splunk Volume Sizes are probably fine at defaults
  splunk_volume_sizes = {
    "cluster_master" = {
      "swap" : 8,           # minimum: 8
      "/" : 20,             # minimum: 20
      "/home" : 4,          # minimum: 4
      "/var" : 15,          # minimum: 15
      "/var/tmp" : 4,       # minimum: 4
      "/var/log" : 8,       # minimum: 8
      "/var/log/audit" : 8, # minimum: 8
      "/tmp" : 4,           # minimum: 4
      "/opt/splunk" : 30,   # No minimum; not in base image
    },
    "indexer" = {
      "swap" : 8,           # minimum: 8
      "/" : 20,             # minimum: 20
      "/home" : 4,          # minimum: 4
      "/var" : 15,          # minimum: 15
      "/var/tmp" : 4,       # minimum: 4
      "/var/log" : 8,       # minimum: 8
      "/var/log/audit" : 8, # minimum: 8
      "/tmp" : 4,           # minimum: 4
      "/opt/splunk" : 30,   # No minimum; not in base image
    },
    "searchhead" = {
      "swap" : 8,           # minimum: 8
      "/" : 20,             # minimum: 20
      "/home" : 4,          # minimum: 4
      "/var" : 15,          # minimum: 15
      "/var/tmp" : 4,       # minimum: 4
      "/var/log" : 8,       # minimum: 8
      "/var/log/audit" : 8, # minimum: 8
      "/tmp" : 4,           # minimum: 4
      "/opt/splunk" : 60,   # No minimum; not in base image
    },
    "customer_searchhead" = {
      "swap" : 8,           # minimum: 8
      "/" : 20,             # minimum: 20
      "/home" : 4,          # minimum: 4
      "/var" : 15,          # minimum: 15
      "/var/tmp" : 4,       # minimum: 4
      "/var/log" : 8,       # minimum: 8
      "/var/log/audit" : 8, # minimum: 8
      "/tmp" : 4,           # minimum: 4
      "/opt/splunk" : 60,   # No minimum; not in base image
    },
    "heavy_forwarder" = {
      "swap" : 8,           # minimum: 8
      "/" : 20,             # minimum: 20
      "/home" : 4,          # minimum: 4
      "/var" : 15,          # minimum: 15
      "/var/tmp" : 4,       # minimum: 4
      "/var/log" : 8,       # minimum: 8
      "/var/log/audit" : 8, # minimum: 8
      "/tmp" : 4,           # minimum: 4
      "/opt/splunk" : 30,   # No minimum; not in base image
    },
  }

  # ALSI - Aggregated Log Source Ingestion
  #
  # If cribl is being used for log ingestion, remember to turn on splunk_private_hec, too.
  alsi_workers     = 0     # how many cribl workers
  alsi_splunk_nlb  = false # splunk://moose-alsi-splunk.xdr{,test}.accenturefederalcyber.com:9997 and 9998
  alsi_elastic_alb = false # https://moose-alsi-elastic.xdr{,test}.accenturefederalcyber.com -> 9200
  alsi_hec_alb     = false # https://moose-alsi-hec.xdr{,test}.accenturefederalcyber.com -> 8080
}