xdr-terraform-live/test/aws-us-gov/mdr-test-c2/account.hcl

# Set account-wide variables. These are automatically pulled in to configure the remote state bucket in the root
# terragrunt.hcl configuration.
locals {
  account_name   = "afs-mdr-test-c2-gov"
  account_alias  = "afs-mdr-test-c2-gov"
  aws_account_id = "738800754746"
  instance_termination_protection = false # set to true for production!
  splunk_prefix = "moose"
  splunk_private_hec = true # True if the customer needs a private HTTP Event Collector such as for ALSI

  # Additional sources that are allowed to send data, such as Customer LCPs, Azure, etc.
  splunk_data_sources = [
    "170.248.172.0/23", # ?
    "20.190.250.137/32", # ?
    "52.232.227.197/32", # ?
    "52.185.64.173/32", # ?
    "52.242.225.98/32", # ?
    "52.177.84.83/32", # ?
    "199.16.64.3/32", #?
    "99.56.213.129/32", # Fred Damstra's Home IP - For testing
  ]
  splunk_legacy_cidr = [ # Allow splunk ports to/from here, too
    "10.96.0.0/16",
  ]
  splunk_asg_sizes = [ 1, 1, 1 ] # How many?
  splunk_volume_sizes = {
    "cluster_master" = {
      "swap": 8,  # minimum: 8
      "/": 10,    # minimum: 10
      "/home": 4, # minimum: 4
      "/var": 15, # minimum: 15
      "/var/tmp": 4, # minimum: 4
      "/var/log": 8, # minimum: 8
      "/var/log/audit": 8, # minimum: 8
      "/tmp": 4,  # minimum: 4
      "/opt/splunk": 30, # No minimum; not in base image
    },
    "indexer" = {
      "swap": 8,  # minimum: 8
      "/": 10,    # minimum: 10
      "/home": 4, # minimum: 4
      "/var": 15, # minimum: 15
      "/var/tmp": 4, # minimum: 4
      "/var/log": 8, # minimum: 8
      "/var/log/audit": 8, # minimum: 8
      "/tmp": 4,  # minimum: 4
      "/opt/splunk": 30, # No minimum; not in base image
    },
    "searchhead" = {
      "swap": 8,  # minimum: 8
      "/": 10,    # minimum: 10
      "/home": 4, # minimum: 4
      "/var": 15, # minimum: 15
      "/var/tmp": 4, # minimum: 4
      "/var/log": 8, # minimum: 8
      "/var/log/audit": 8, # minimum: 8
      "/tmp": 4,  # minimum: 4
      "/opt/splunk": 30, # No minimum; not in base image
    },
    "qcompliance" = {
      "swap": 8,  # minimum: 8
      "/": 10,    # minimum: 10
      "/home": 4, # minimum: 4
      "/var": 15, # minimum: 15
      "/var/tmp": 4, # minimum: 4
      "/var/log": 8, # minimum: 8
      "/var/log/audit": 8, # minimum: 8
      "/tmp": 4,  # minimum: 4
      "/opt/splunk": 30, # No minimum; not in base image
    },
    "heavy_forwarder" = {
      "swap": 8,  # minimum: 8
      "/": 10,    # minimum: 10
      "/home": 4, # minimum: 4
      "/var": 15, # minimum: 15
      "/var/tmp": 4, # minimum: 4
      "/var/log": 8, # minimum: 8
      "/var/log/audit": 8, # minimum: 8
      "/tmp": 4,  # minimum: 4
      "/opt/splunk": 30, # No minimum; not in base image
    },
  }
  
  account_tags = {
    "Client": local.splunk_prefix,
  } 

  c2_account_standards_path = "../../mdr-test-c2/005-account-standards-c2"

  # For CIDR assignment, see https://github.mdr.defpoint.com/mdr-engineering/msoc-infrastructure/wiki/IP-Address-Allocation
  vpc_info = {
    "vpc-splunk" = {
      "name" = "vpc-splunk"
      "purpose" = "Splunk Systems (MOOSE)"
      "cidr" = "10.20.16.0/22",
      "tgw_attached" = true,
    },
    "vpc-system-services" = {
      "name" = "vpc-system-services",
      "purpose" = "Internal Services for Systems (not people)",
      "cidr" = "10.20.0.0/22",
      "tgw_attached" = false, # NOTE: This is attached via the transit gateway creation
    },
    "vpc-qualys" = {
      "name" = "vpc-qualys",
      "purpose" = "Security Scanning",
      "cidr" = "10.20.12.0/22",
      "tgw_attached" = true,
    },
    "vpc-interconnects" = {
      "name" = "vpc-interconnects",
      "purpose" = "Interconnections between AWS partitions",
      "cidr" = "10.179.128.0/22",
      "tgw_attached" = false,
    },
    "vpc-access" = {
      "name" = "vpc-access"
      "purpose" = "Systems providing restricted access, such as bastions and vpn concentrators"
      "cidr" = "10.20.20.0/22"
      "tgw_attached" = true,
    },
    "vpc-portal" = {
      "name" = "vpc-portal"
      "purpose" = "The Customer Portal"
      "cidr" = "10.20.32.0/24"
      "tgw_attached" = true,
    },
    "vpc-public" = {
      "name" = "vpc-public"
      "purpose" = "Publicly Accessible Infrastructure Services, such as GHE and Jira"
      "cidr" = "10.20.24.0/22"
      "tgw_attached" = true,
    },
    "vpc-private-services" = {
      "name" = "vpc-private-services"
      "purpose" = "Private XDR Services for XDR users"
      "cidr" = "10.20.28.0/22"
      "tgw_attached" = true,
    },
  }

  instance_types = {
    "alsi-master"    = "t3a.small",
    "alsi-worker"    = "t3a.small",
    "github"         = "c5.2xlarge", # legacy: c4.4xlarge in prod, c5.2xlarge in test
    "github-backup"  = "t3a.medium", # legacy: t2.micro
    "jira-rds"       = "db.t3.medium",
    "jira-server"    = "t3a.small", # legacy test: t2.small, legacy prod: t2.medium
    "phantom"        = "t3a.medium", # legacy test: t2.medium, legacy prod: m4.4xlarge
    "qcompliance"    = "t3a.small", # legacy: ? not sure
    "splunk-cm"      = "t3a.small",  # legacy: t2.small
    "splunk-hf"      = "t3a.small", # legacy: t2.medium
    #"splunk-indexer" = "t3a.small", # legacy: t2.small, but whats the point if we don't have instance storage.
    #"splunk-indexer" = "i3en.large", # legacy: t2.small, but whats the point if we don't have instance storage.
    #"splunk-indexer" = "m5d.large", # these are 1/2 the price of i3en.larges. 8GB RAM, 75GB storage
    "splunk-indexer" = "m5d.xlarge", # 16GB RAM, 150GB SSD
    "splunk-sh"      = "t3a.small", # legacy: ? not sure
  }

  # TODO: The instance types below should be moved to the instance_type map above
  # DNS Resolver
  resolver_instance_type = "t3a.micro"

  # Bastion
  bastion_instance_type = "t3a.micro"

  # Salt Master
  salt_master_instance_type = "t3a.large"

  # Mail Relay Server
  mailrelay_instance_type = "t3a.micro"

  # OpenVPN Server
  openvpn_instance_type = "t3a.medium"

  # Phantom Server
  phantom_instance_count = 1

  # Proxy Server
  proxy_server_instance_type = "t3a.micro"

  # Repo Server
  repo_server_instance_type = "t3a.micro"

  # Vault Server
  vault_server_instance_type = "t3a.micro"

  # Sensu Server
  sensu_server_instance_type = "t3a.medium"

  # Github Servers
  github_instance_count = 1
  github_data_volume_size = 500

  # ALSI Servers
  alsi_workers = 2
  alsi_splunk_nlb = true # splunk://moose-alsi-splunk.xdr{,test}.accenturefederalcyber.com:9997 and 9998
  alsi_elastic_alb = true # https://moose-alsi-elastic.xdr{,test}.accenturefederalcyber.com -> 9200
  alsi_hec_alb = true # https://moose-alsi-hec.xdr{,test}.accenturefederalcyber.com -> 8080

  # For testing:
  # Note: instead of changing this here, you can pass parameters to terragrunt on the CLI, such as:
  #   TFVAR_create_test_instance=true TFVAR_test_instance_ami=base terragrunt apply
  create_test_instance = false
  # Extra customization if you want it
  #test_instance_key_name = "fdamstra" # They with which to provision the test instance
  #test_instance_ami = "base" # default = minion
  #test_instance_type = "t3a.micro" # default = t3a.micro

  # AS Number used for various resources, but not every account needs one.
  asn = 64710 # changing this replaces the gateway

  # Interconnects
  interconnect_asn = 64777
  interconnects_instance_type = "t3a.micro"
  interconnects_key_name = "fdamstra" # DO NOT CHANGE
  interconnects_count = 2
  interconnect_instances_path = "../018-interconnect-instances"

  # Qualys Scanners
  qualys_personalization_codes = {
    standard = "21009597903247"
    preauthorized = "21005906078774"
  }

  # Qualys Connector
  qualys_connector_externalid = "1601148045651" # Needs to come from the qualys console
}