FredsHoneyPot/splunk_server.j

{% import 'variables.include' as var %}

###################
# Splunk_Server Instance
resource "aws_instance" "splunk-hp" {
  ami = data.aws_ami.ubuntu.id
#  ami = data.aws_ami.centos7.id
  instance_type = var.Splunk-Instance-Type
  availability_zone = data.aws_availability_zones.available.names[0]
  subnet_id = aws_subnet.subnet_Splunk.id
  private_ip = var.Splunk-IP
  ebs_optimized = var.EBS-Optimized
  disable_api_termination = false
  associate_public_ip_address = true
  instance_initiated_shutdown_behavior = "terminate"
  key_name = var.AWS-Key-Pair-Name
  vpc_security_group_ids = [aws_security_group.sg_splunk_secured_access.id]
  depends_on    = [aws_internet_gateway.gw_primary]

  tags = {
    Name = "splunk-hp"
  }

  root_block_device {
    volume_type =  var.Default-Volume-Type
    volume_size =  var.Splunk-Volume-Size # Gigabytes
    delete_on_termination = true
  }

  ebs_block_device {
    device_name = "/dev/sdd"
    volume_size = var.Swap-Volume-Size
    volume_type = var.Swap-Volume-Type
    delete_on_termination = true
  }

  user_data = <<EOF
#cloud-config
package_update: true
package_upgrade: true
packages:
  - git
  - vim
  - wget
  - curl
  - tcpdump
  - python
  - iptables-persistent
runcmd:
  - mkswap /dev/xvdd
  - swapon -a
  - git clone https://github.com/fdamstra/python_multithreaded_socket_logger.git /opt/multithreaded_socket_logger
  - bash /opt/multithreaded_socket_logger/splunkserver_init.sh
mounts:
  - [ xvdd, none, swap, sw, 0, 0 ]
growpart:
  mode: auto
  devices: ['/']
  ignore_growroot_disabled: false
power_state:
  mode: "reboot"
  message: "Rebooting after first init."
  condition: True
EOF
# To reboot, add the following above the EOF line:
# power_state:
#   delay: "+10"
#   mode: "reboot"
#   message: "Rebooting after first init."
#   condition: True

  # Fix issues with cached keys. Arguably less secure, but also way less annoying
  provisioner "local-exec" {
    command = "ssh-keygen -f ~/.ssh/known_hosts -R splunk-hp.lab.${var.Domain-Name}"
  }
}

# Give me the IP Addresses
output "splunk-hp_ip" {
    value = aws_instance.splunk-hp.public_ip
}

# Give me DNS entries
resource "aws_route53_record" "splunk-hp" {
  zone_id = var.Domain-Zone-ID
  name = "splunk-hp.lab.${var.Domain-Name}"
  type = "A"
  ttl = "300"
  records = [aws_instance.splunk-hp.public_ip]
}
resource "aws_route53_record" "splunk-hp_pvt" {
  zone_id = var.Domain-Zone-ID
  name = "splunk-hp_pvt.lab.${var.Domain-Name}"
  type = "A"
  ttl = "300"
  records = [aws_instance.splunk-hp.private_ip]
}
output "splunk-hp_dns" {
  value = aws_route53_record.splunk-hp.name
}