locals { instance_types_default = { "alsi-master" = "t3a.small", "alsi-worker" = "t3a.small", } instance_types_exceptions = { } instance_types = lookup(local.instance_types_exceptions, var.account_name, local.instance_types_default) # If cribl is being used for log ingestion, remember to turn on splunk_private_hec # in `splunk_servers/indexer_cluster/config.tf`, too. # Alternatively, enable the Splunk Load Balanced destination and use indexer discovery. alsi_workers_default = 0 # how many cribl workers alsi_workers_exceptions = { afs-mdr-test-c2-gov = 2, mdr-prod-bas = 2, } alsi_workers = lookup(local.alsi_workers_exceptions, var.account_name, local.alsi_workers_default) alsi_splunk_nlb_default = false # splunk://moose-alsi-splunk.xdr{,test}.accenturefederalcyber.com:9997 and 9998 alsi_splunk_nlb_exceptions = { afs-mdr-test-c2-gov = true, mdr-prod-bas = true, } alsi_splunk_nlb = lookup(local.alsi_splunk_nlb_exceptions, var.account_name, local.alsi_splunk_nlb_default) alsi_elastic_alb_default = false # https://moose-alsi-elastic.xdr{,test}.accenturefederalcyber.com -> 9200 alsi_elastic_alb_exceptions = { afs-mdr-test-c2-gov = true, } alsi_elastic_alb = lookup(local.alsi_elastic_alb_exceptions, var.account_name, local.alsi_elastic_alb_default) alsi_hec_alb_default = false # https://moose-alsi-hec.xdr{,test}.accenturefederalcyber.com -> 8088 alsi_hec_alb_exceptions = { afs-mdr-test-c2-gov = true, mdr-prod-bas = true, } alsi_hec_alb = lookup(local.alsi_hec_alb_exceptions, var.account_name, local.alsi_hec_alb_default) }