xdr-terraform-modules/base/threatquotient/main.tf

# Some instance variables
locals {
  ami_selection = "tq" # master, minion, ...
  server_name_stem = "threatq"
  instance_count = 1
  ebs_volume_type = "gp3"
}

# Use the default EBS key
data "aws_kms_key" "ebs-key" {
  key_id = "alias/ebs_root_encrypt_decrypt"
}

resource "aws_instance" "instance" {
  count = local.instance_count

  tenancy = "default"
  ebs_optimized = true
  disable_api_termination = var.instance_termination_protection
  instance_initiated_shutdown_behavior = "stop"
  instance_type = var.instance_type
  key_name = "msoc-build"
  monitoring = false
  iam_instance_profile = "msoc-default-instance-profile"
  associate_public_ip_address = false
  vpc_security_group_ids = [ data.aws_security_group.typical-host.id, aws_security_group.instance.id ]
  subnet_id = var.public_subnets[count.index % 3]

  ami = local.ami_map[local.ami_selection]
  # We need to ignore ebs_block_device changes, because if the AMI changes, so does the snapshot_id.
  # If they add a feature to block more specific changes (eg `ebs_block_devices[*].snapshot_id`), then
  # that could be removed.
  lifecycle { ignore_changes = [ ami, key_name, user_data, ebs_block_device ] }

  # These device definitions are optional, but added for clarity.
  root_block_device {
      volume_type = local.ebs_volume_type
      volume_size = "60"
      delete_on_termination = true
      encrypted = true
      kms_key_id = data.aws_kms_key.ebs-key.arn
  }

  ebs_block_device {
    # swap
    device_name = "/dev/xvdm"
    volume_type = local.ebs_volume_type
    #volume_size = 48
    delete_on_termination = true
    encrypted = true
    kms_key_id = data.aws_kms_key.ebs-key.arn
    # Snapshot IDs need to be grabbed from the ami, or it will replace every time. It's ugly.
    # This may prompt replacement when the AMI is updated.
    # See:
    #   https://github.com/hashicorp/terraform/issues/19958
    #   https://github.com/terraform-providers/terraform-provider-aws/issues/13118
    snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdm"].ebs.snapshot_id
  }
  ebs_block_device {
    # /home
    device_name = "/dev/xvdn"
    volume_type = local.ebs_volume_type
    # volume_size = xx
    delete_on_termination = true
    encrypted = true
    kms_key_id = data.aws_kms_key.ebs-key.arn
    snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdn"].ebs.snapshot_id
  }
  ebs_block_device {
    # /var
    device_name = "/dev/xvdo"
    volume_type = local.ebs_volume_type
    volume_size = 80
    delete_on_termination = true
    encrypted = true
    kms_key_id = data.aws_kms_key.ebs-key.arn
    snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdo"].ebs.snapshot_id
  }
  ebs_block_device {
    # /var/tmp
    device_name = "/dev/xvdp"
    volume_type = local.ebs_volume_type
    # volume_size = xx
    delete_on_termination = true
    encrypted = true
    kms_key_id = data.aws_kms_key.ebs-key.arn
    snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdp"].ebs.snapshot_id
  }
  ebs_block_device {
    # /var/log
    device_name = "/dev/xvdq"
    volume_type = local.ebs_volume_type
    # volume_size = xx
    delete_on_termination = true
    encrypted = true
    kms_key_id = data.aws_kms_key.ebs-key.arn
    snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdq"].ebs.snapshot_id
  }
  ebs_block_device {
    # /var/log/audit
    device_name = "/dev/xvdr"
    volume_type = local.ebs_volume_type
    # volume_size = xx
    delete_on_termination = true
    encrypted = true
    kms_key_id = data.aws_kms_key.ebs-key.arn
    snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvdr"].ebs.snapshot_id
  }
  ebs_block_device {
    # /tmp
    device_name = "/dev/xvds"
    volume_type = local.ebs_volume_type
    # volume_size = xx
    delete_on_termination = true
    encrypted = true
    kms_key_id = data.aws_kms_key.ebs-key.arn
    snapshot_id = local.block_device_mappings[local.ami_selection]["/dev/xvds"].ebs.snapshot_id
  }

  user_data = data.template_cloudinit_config.cloud_init_config[count.index].rendered
  tags = merge( var.standard_tags, var.tags, { Name = "${local.server_name_stem}-${count.index}" })
  volume_tags = merge( var.standard_tags, var.tags, { Name = "${local.server_name_stem}-${count.index}" })
}

module "private_dns_record" {
  count = local.instance_count

  source = "../../submodules/dns/private_A_record"

  name = "${local.server_name_stem}-${count.index}"
  ip_addresses = [ aws_instance.instance[count.index].private_ip ]
  dns_info = var.dns_info
  reverse_enabled = var.reverse_enabled

  providers = {
    aws.c2 = aws.c2
  }
}

#module "public_dns_record" {
#  source = "../../submodules/dns/public_A_record"
#
#  name = var.instance_name
#  ip_addresses = [ aws_eip.instance.public_ip ]
#  dns_info = var.dns_info
#
#  providers = {
#    aws.mdr-common-services-commercial = aws.mdr-common-services-commercial
#  }
#}

# Render a multi-part cloud-init config making use of the part
# above, and other source files
data "template_cloudinit_config" "cloud_init_config" {
  count = local.instance_count

  gzip          = true
  base64_encode = true

  # Main cloud-config configuration file.
  part {
    filename     = "init.cfg"
    content_type = "text/cloud-config"
    content      = templatefile("${path.module}/cloud-init/cloud-init.tpl",
      {
        hostname = "${local.server_name_stem}-${count.index}"
        fqdn = "${local.server_name_stem}-${count.index}.${var.dns_info["private"]["zone"]}"
        environment = var.environment
        salt_master  = var.salt_master
        proxy = var.proxy
        aws_partition = var.aws_partition
        aws_partition_alias = var.aws_partition_alias
        aws_region = var.aws_region
      }
    )
  }

  # mount /dev/xvdf at /opt/tqbackup
  part {
    content_type = "text/cloud-boothook"
    content      = file("${path.module}/cloud-init/opt_tqbackup.boothook")
  }

}