mirror of
https://github.com/Sea-Haven-Industries/syslog-server.git
synced 2026-09-30 13:33:16 +00:00
e17b284370
* feat(infra): migrate syslog-server to HCP Terraform Replace the mgmt CDK stack with a seahaven-prod HCP workspace so the collector is owned by Terraform before UniFi cutover. * fix(infra): keep no-logs alarm quiet until UniFi cutover The new prod unifi-syslog group is empty until devices are re-pointed, so treat_missing_data=breaching would page site-alerts on first apply. * fix(infra): allow scoped apply to modify SG rules in place Authorize/Revoke plus description updates are not enough for aws_vpc_security_group_*_rule in-place changes after the bootstrap window.
123 lines
3.1 KiB
HCL
123 lines
3.1 KiB
HCL
data "aws_availability_zones" "available" {
|
|
state = "available"
|
|
}
|
|
|
|
resource "aws_vpc" "this" {
|
|
cidr_block = local.vpc_cidr
|
|
enable_dns_support = true
|
|
enable_dns_hostnames = true
|
|
|
|
tags = {
|
|
Name = "syslog-server-vpc"
|
|
}
|
|
}
|
|
|
|
resource "aws_internet_gateway" "this" {
|
|
vpc_id = aws_vpc.this.id
|
|
|
|
tags = {
|
|
Name = "syslog-server-igw"
|
|
}
|
|
}
|
|
|
|
resource "aws_subnet" "public" {
|
|
vpc_id = aws_vpc.this.id
|
|
cidr_block = local.public_subnet_cidr
|
|
availability_zone = data.aws_availability_zones.available.names[0]
|
|
map_public_ip_on_launch = true
|
|
|
|
tags = {
|
|
Name = "syslog-server-public"
|
|
}
|
|
}
|
|
|
|
resource "aws_route_table" "public" {
|
|
vpc_id = aws_vpc.this.id
|
|
|
|
tags = {
|
|
Name = "syslog-server-public"
|
|
}
|
|
}
|
|
|
|
resource "aws_route" "public_default" {
|
|
route_table_id = aws_route_table.public.id
|
|
destination_cidr_block = "0.0.0.0/0"
|
|
gateway_id = aws_internet_gateway.this.id
|
|
}
|
|
|
|
resource "aws_route_table_association" "public" {
|
|
subnet_id = aws_subnet.public.id
|
|
route_table_id = aws_route_table.public.id
|
|
}
|
|
|
|
resource "aws_security_group" "this" {
|
|
name = "syslog-server"
|
|
description = "Syslog collector - rsyslog 514 from office + VPC"
|
|
vpc_id = aws_vpc.this.id
|
|
|
|
tags = {
|
|
Name = "syslog-server"
|
|
}
|
|
}
|
|
|
|
resource "aws_vpc_security_group_egress_rule" "all" {
|
|
security_group_id = aws_security_group.this.id
|
|
ip_protocol = "-1"
|
|
cidr_ipv4 = "0.0.0.0/0"
|
|
description = "All outbound for package installs and CloudWatch"
|
|
}
|
|
|
|
resource "aws_vpc_security_group_ingress_rule" "syslog_tcp" {
|
|
for_each = toset(local.syslog_ingress_cidrs)
|
|
|
|
security_group_id = aws_security_group.this.id
|
|
ip_protocol = "tcp"
|
|
from_port = 514
|
|
to_port = 514
|
|
cidr_ipv4 = each.value
|
|
description = "syslog TCP 514"
|
|
}
|
|
|
|
resource "aws_vpc_security_group_ingress_rule" "syslog_udp" {
|
|
for_each = toset(local.syslog_ingress_cidrs)
|
|
|
|
security_group_id = aws_security_group.this.id
|
|
ip_protocol = "udp"
|
|
from_port = 514
|
|
to_port = 514
|
|
cidr_ipv4 = each.value
|
|
description = "syslog UDP 514"
|
|
}
|
|
|
|
resource "aws_vpc_security_group_ingress_rule" "ssh" {
|
|
for_each = toset(local.ssh_ingress_cidrs)
|
|
|
|
security_group_id = aws_security_group.this.id
|
|
ip_protocol = "tcp"
|
|
from_port = 22
|
|
to_port = 22
|
|
cidr_ipv4 = each.value
|
|
description = "SSH break-glass"
|
|
}
|
|
|
|
resource "aws_vpc_security_group_ingress_rule" "netflow_2055" {
|
|
for_each = toset(local.office_cidrs)
|
|
|
|
security_group_id = aws_security_group.this.id
|
|
ip_protocol = "udp"
|
|
from_port = 2055
|
|
to_port = 2055
|
|
cidr_ipv4 = each.value
|
|
description = "netflow/sflow UDP 2055"
|
|
}
|
|
|
|
resource "aws_vpc_security_group_ingress_rule" "netflow_2056" {
|
|
for_each = toset(local.office_cidrs)
|
|
|
|
security_group_id = aws_security_group.this.id
|
|
ip_protocol = "udp"
|
|
from_port = 2056
|
|
to_port = 2056
|
|
cidr_ipv4 = each.value
|
|
description = "netflow/sflow UDP 2056"
|
|
}
|