xdr-terraform-modules/base/splunk_servers/indexer_cluster/security-group-elbs.tf

## Indexer Security Group
#
# Summary:
#   Ingress:
#     tcp/8088      - Splunk HEC                 - (local.data_sources) Entire VPC + var.additional_source + local.splunk_legacy_cidr
#   Egress:
#     tcp/8088      - Splunk HEC

# Defined in security-group-indexers.tf:
#locals {
#  splunk_vpc_cidrs = toset(concat(local.splunk_legacy_cidr, [ var.vpc_cidr ]))
#  access_cidrs     = toset(concat(local.cidr_map["bastions"], local.cidr_map["vpns"]))
#  data_sources     = toset(concat(tolist(local.splunk_vpc_cidrs), local.splunk_data_sources))
#}

resource "aws_security_group" "hec_elb_security_group" {
  name        = "hec_elb_security_group"
  description = "Security Group for HEC ELBs (both ack and non-ack)"
  vpc_id      = var.vpc_id
  tags        = merge(local.standard_tags, var.tags, { "Name" = "hec_elb_security_group" })
}

#----------------------------------------------------------------------------
# INGRESS
#----------------------------------------------------------------------------
resource "aws_security_group_rule" "hec-https-in" {
  count             = anytrue([local.is_moose, var.hec_listen_443]) ? 1 : 0
  type              = "ingress"
  description       = "HEC port - HTTPS - Moose only"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"] # tfsec:ignore:aws-vpc-no-public-ingress-sgr
  security_group_id = aws_security_group.hec_elb_security_group.id
}

resource "aws_security_group_rule" "hec-in" {
  type              = "ingress"
  description       = "HEC port in"
  from_port         = 8088
  to_port           = 8088
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"] # tfsec:ignore:aws-vpc-no-public-ingress-sgr
  security_group_id = aws_security_group.hec_elb_security_group.id
}

#----------------------------------------------------------------------------
# INGRESS
#----------------------------------------------------------------------------
resource "aws_security_group_rule" "hec-out" {
  type              = "egress"
  description       = "HEC to the indexers"
  from_port         = 8088
  to_port           = 8088
  protocol          = "tcp"
  cidr_blocks       = local.splunk_vpc_cidrs
  security_group_id = aws_security_group.hec_elb_security_group.id
}