Skip to content

README.md

Latest commit

 

History

History
139 lines (115 loc) · 8.04 KB

README.md

File metadata and controls

139 lines (115 loc) · 8.04 KB
Raw

Logging Destination: Splunk

This addon configures AWS Kinesis Firehose to send Fleet's osquery logs to Splunk. It creates:

  1. Kinesis Firehose delivery streams for each log type (results, status, and audit)
  2. A single S3 bucket for storing all failed delivery attempts
  3. IAM roles and policies for the Firehose streams to access the S3 bucket
  4. An IAM policy for Fleet to access the Firehose streams

How to use

module "splunk-logging" {
  source = "github.com/fleetdm/fleet-terraform//addons/logging-destination-splunk?depth=1&ref=tf-mod-addon-logging-destination-splunk-v1.0.1"

  s3_bucket_config = {
    name_prefix  = "fleet-splunk-failure"
    expires_days = 5
  }

  log_destinations = {
    results = {
      name                        = "fleet-osquery-results-splunk"
      hec_endpont                 = "https://http-inputs-mydomain.splunkcloud.com:443"
      hec_token                   = "51D4DA16-C61B-4F5F-8EC7-ED4301342A4A"
      hec_acknowledgement_timeout = 600
      hec_endpoint_type           = "Raw"
      s3_buffering_size           = 10
      s3_buffering_interval       = 400
      s3_error_output_prefix      = "results/"
    },
    status = {
      name                        = "fleet-osquery-status-splunk"
      hec_endpont                 = "https://http-inputs-mydomain.splunkcloud.com:443"
      hec_token                   = "51D4DA16-C61B-4F5F-8EC7-ED4301342A4A"
      hec_acknowledgement_timeout = 600
      hec_endpoint_type           = "Raw"
      s3_buffering_size           = 10
      s3_buffering_interval       = 400
      s3_error_output_prefix      = "status/"
    },
    audit = {
      name                        = "fleet-audit-splunk"
      hec_endpont                 = "https://http-inputs-mydomain.splunkcloud.com:443"
      hec_token                   = "51D4DA16-C61B-4F5F-8EC7-ED4301342A4A"
      hec_acknowledgement_timeout = 600
      hec_endpoint_type           = "Raw"
      s3_buffering_size           = 10
      s3_buffering_interval       = 400
      s3_error_output_prefix      = "audit/"
    }
  }
}

Then you can use the module's outputs in your Fleet configuration:

module "fleet" {
  source = "github.com/fleetdm/fleet-terraform?depth=1&ref=tf-mod-root-v1.26.1"
  certificate_arn = module.acm.acm_certificate_arn

  vpc = {
    name = local.vpc_name
    # azs = ["us-east-2a", "us-east-2b", "us-east-2c"]
  }

  fleet_config = {
    image = "fleetdm/fleet:v4.70.1"
    autoscaling = {
      min_capacity = 2
      max_capacity = 5
    }
    mem = 4096
    cpu = 512
    extra_environment_variables = merge(
      local.fleet_environment_variables,
      # Uncomment to enable Splunk logging
      module.splunk-logging.fleet_extra_environment_variables
    )
    extra_iam_policies = concat(
      # Uncomment to enable Splunk logging
      module.splunk-logging.fleet_extra_iam_policies,
    )
  }

  # ... other Fleet configuration ...
}

Requirements

No requirements.

Providers

Name Version
aws 6.41.0

Modules

No modules.

Resources

Name Type
aws_iam_policy.firehose resource
aws_iam_policy.firehose-logging resource
aws_iam_role.firehose resource
aws_iam_role_policy_attachment.firehose resource
aws_kinesis_firehose_delivery_stream.splunk resource
aws_s3_bucket.splunk-failure resource
aws_s3_bucket_lifecycle_configuration.splunk-failure resource
aws_s3_bucket_public_access_block.splunk-failure resource
aws_s3_bucket_server_side_encryption_configuration.splunk-failure resource
aws_iam_policy_document.firehose-logging data source
aws_iam_policy_document.firehose_policy data source
aws_iam_policy_document.osquery_firehose_assume_role data source
aws_region.current data source

Inputs

Name Description Type Default Required
compression_format Compression format for the Firehose delivery stream string "UNCOMPRESSED" no
iam_policy_name n/a string "splunk-firehose-policy" no
log_destinations A map of configurations for Splunk Firehose delivery streams. 
map(object({
    # hec endpoint/token are logically optional but validated to enforce 
    name                        = string
    hec_endpoint                = optional(string)
    hec_token                   = optional(string)
    hec_acknowledgement_timeout = optional(number, 600)
    hec_endpoint_type           = optional(string, "Raw")
    s3_buffering_size           = optional(number, 2)
    s3_buffering_interval       = optional(number, 400)
    s3_error_output_prefix      = optional(string, null)

  }))
 
{
  "audit": {
    "hec_acknowledgement_timeout": 600,
    "hec_endpoint_type": "Raw",
    "name": "fleet-audit-splunk",
    "s3_buffering_interval": 400,
    "s3_buffering_size": 10,
    "s3_error_output_prefix": "audit/"
  },
  "results": {
    "hec_acknowledgement_timeout": 600,
    "hec_endpoint_type": "Raw",
    "name": "fleet-osquery-results-splunk",
    "s3_buffering_interval": 400,
    "s3_buffering_size": 10,
    "s3_error_output_prefix": "results/"
  },
  "status": {
    "hec_acknowledgement_timeout": 600,
    "hec_endpoint_type": "Raw",
    "name": "fleet-osquery-status-splunk",
    "s3_buffering_interval": 400,
    "s3_buffering_size": 10,
    "s3_error_output_prefix": "status/"
  }
}
 no
s3_bucket_config Configuration for the S3 bucket used to store failed Splunk delivery attempts 
object({
    name_prefix  = optional(string, "fleet-splunk-failure")
    expires_days = optional(number, 1)
  })
 
{
  "expires_days": 1,
  "name_prefix": "fleet-splunk-failure"
}
 no

Outputs

Name Description
fleet_extra_environment_variables Environment variables to configure Fleet to use Splunk logging via Firehose
fleet_extra_iam_policies IAM policies required for Fleet to log to Splunk via Firehose
fleet_s3_splunk_failure_config S3 bucket details - splunk-failure