From 3866c64a9f3f12b4936a2d528f8aacf243319a99 Mon Sep 17 00:00:00 2001 From: Andrew Svoboda Date: Thu, 23 May 2019 16:17:40 -0700 Subject: [PATCH 1/3] Add outputs and run terraform fmt --- Terraform/locals.tf | 4 +++ Terraform/main.tf | 48 ++++++++++++++++++++++---------- Terraform/outputs.tf | 8 ++++++ Terraform/variables.tf | 63 +++++++++++++++++++++++++----------------- 4 files changed, 83 insertions(+), 40 deletions(-) create mode 100644 Terraform/locals.tf diff --git a/Terraform/locals.tf b/Terraform/locals.tf new file mode 100644 index 0000000..70f9603 --- /dev/null +++ b/Terraform/locals.tf @@ -0,0 +1,4 @@ +locals { + fleet_url = "https://${aws_instance.logger.public_ip}:8412" + splunk_url = "https://${aws_instance.logger.public_ip}:8000" +} diff --git a/Terraform/main.tf b/Terraform/main.tf index a2cc2ea..353f90d 100644 --- a/Terraform/main.tf +++ b/Terraform/main.tf @@ -1,8 +1,8 @@ # Specify the provider and access details provider "aws" { shared_credentials_file = "${var.shared_credentials_file}" - region = "${var.region}" - profile = "${var.profile}" + region = "${var.region}" + profile = "${var.profile}" } # Create a VPC to launch our instances into @@ -36,6 +36,7 @@ resource "aws_vpc_dhcp_options" "default" { domain_name_servers = ["${aws_instance.dc.private_ip}", "${var.external_dns_servers}"] netbios_name_servers = ["${aws_instance.dc.private_ip}"] } + resource "aws_vpc_dhcp_options_association" "default" { vpc_id = "${aws_vpc.default.id}" dhcp_options_id = "${aws_vpc_dhcp_options.default.id}" @@ -141,14 +142,17 @@ resource "aws_key_pair" "auth" { resource "aws_instance" "logger" { instance_type = "t2.medium" - ami = "ami-0ad16744583f21877" + ami = "ami-0ad16744583f21877" + tags { Name = "logger" } - subnet_id = "${aws_subnet.default.id}" + + subnet_id = "${aws_subnet.default.id}" vpc_security_group_ids = ["${aws_security_group.logger.id}"] - key_name = "${aws_key_pair.auth.key_name}" - private_ip = "192.168.38.105" + key_name = "${aws_key_pair.auth.key_name}" + private_ip = "192.168.38.105" + # Provision the AWS Ubuntu 16.04 AMI from scratch. provisioner "remote-exec" { inline = [ @@ -166,28 +170,34 @@ resource "aws_instance" "logger" { "sudo apt-get -qq update", "sudo /opt/DetectionLab/Vagrant/bootstrap.sh", ] + connection { - type = "ssh" - user = "ubuntu" + type = "ssh" + user = "ubuntu" private_key = "${file("${var.private_key_path}")}" } } + root_block_device { delete_on_termination = true - volume_size = 64 + volume_size = 64 } } resource "aws_instance" "dc" { instance_type = "t2.medium" + # Change the below variable to "${var.dc_ami}" if using hardcoded AMIs ami = "${data.aws_ami.dc_ami.image_id}" + tags { Name = "dc.windomain.local" } - subnet_id = "${aws_subnet.default.id}" + + subnet_id = "${aws_subnet.default.id}" vpc_security_group_ids = ["${aws_security_group.windows.id}"] - private_ip = "192.168.38.102" + private_ip = "192.168.38.102" + root_block_device { delete_on_termination = true } @@ -195,14 +205,18 @@ resource "aws_instance" "dc" { resource "aws_instance" "wef" { instance_type = "t2.medium" + # Change the below variable to "${var.wef_ami}" if using hardcoded AMIs ami = "${data.aws_ami.wef_ami.image_id}" + tags { Name = "wef.windomain.local" } - subnet_id = "${aws_subnet.default.id}" + + subnet_id = "${aws_subnet.default.id}" vpc_security_group_ids = ["${aws_security_group.windows.id}"] - private_ip = "192.168.38.103" + private_ip = "192.168.38.103" + root_block_device { delete_on_termination = true } @@ -210,14 +224,18 @@ resource "aws_instance" "wef" { resource "aws_instance" "win10" { instance_type = "t2.medium" + # Change the below variable to "${var.win10_ami}" if using hardcoded AMIs ami = "${data.aws_ami.win10_ami.image_id}" + tags { Name = "win10.windomain.local" } - subnet_id = "${aws_subnet.default.id}" + + subnet_id = "${aws_subnet.default.id}" vpc_security_group_ids = ["${aws_security_group.windows.id}"] - private_ip = "192.168.38.104" + private_ip = "192.168.38.104" + root_block_device { delete_on_termination = true } diff --git a/Terraform/outputs.tf b/Terraform/outputs.tf index 9677bb8..c2336ae 100644 --- a/Terraform/outputs.tf +++ b/Terraform/outputs.tf @@ -29,3 +29,11 @@ output "latest_wef_ami_id" { output "latest_win10_ami_id" { value = "${data.aws_ami.wef_ami.image_id}" } + +output "fleet_url" { + value = "${local.fleet_url}" +} + +output "splunk_url" { + value = "${local.splunk_url}" +} diff --git a/Terraform/variables.tf b/Terraform/variables.tf index 1fb59ad..c90fac8 100644 --- a/Terraform/variables.tf +++ b/Terraform/variables.tf @@ -1,68 +1,79 @@ variable "region" { default = "us-west-1" } + variable "profile" { default = "terraform" } + variable "availability_zone" { description = "https://www.terraform.io/docs/providers/aws/d/availability_zone.html" - default = "" + default = "" } + variable "shared_credentials_file" { description = "Path to your AWS credentials file" - type = "string" - default = "/home/username/.aws/credentials" + type = "string" + default = "/home/username/.aws/credentials" } - variable "public_key_name" { - description = "A name for AWS Keypair to use to auth to logger. Can be anything you specify." - default = "id_logger" - } + +variable "public_key_name" { + description = "A name for AWS Keypair to use to auth to logger. Can be anything you specify." + default = "id_logger" +} + variable "public_key_path" { description = "Path to the public key to be loaded into the logger authorized_keys file" - type = "string" - default = "/home/username/.ssh/id_logger.pub" + type = "string" + default = "/home/username/.ssh/id_logger.pub" } + variable "private_key_path" { description = "Path to the private key to use to authenticate to logger." - type = "string" - default = "/home/username/.ssh/id_logger" + type = "string" + default = "/home/username/.ssh/id_logger" } + variable "ip_whitelist" { description = "A list of CIDRs that will be allowed to access the EC2 instances" - type = "list" - default = [""] + type = "list" + default = [""] } + variable "external_dns_servers" { description = "Configure lab to allow external DNS resolution" - type = "list" - default = ["8.8.8.8"] + type = "list" + default = ["8.8.8.8"] } # Use Data Sources to resolve the AMI-ID for the pre-built DC host data "aws_ami" "dc_ami" { owners = ["505638924199"] + filter { - name = "name" + name = "name" values = ["detectionlab-dc"] } } - # Use Data Sources to resolve the AMI-ID for the pre-built WEF host +# Use Data Sources to resolve the AMI-ID for the pre-built WEF host data "aws_ami" "wef_ami" { - owners = ["505638924199"] + owners = ["505638924199"] most_recent = true + filter { - name = "name" + name = "name" values = ["detectionlab-wef"] } } - # Use Data Sources to resolve the AMI-ID for the pre-built Win10 host +# Use Data Sources to resolve the AMI-ID for the pre-built Win10 host data "aws_ami" "win10_ami" { - owners = ["505638924199"] + owners = ["505638924199"] most_recent = true + filter { - name = "name" + name = "name" values = ["detectionlab-win10"] } } @@ -71,14 +82,16 @@ data "aws_ami" "win10_ami" { # If you are building your own AMIs, replace the default values below with # the AMI IDs variable "dc_ami" { - type = "string" + type = "string" default = "ami-03e2df055c632a0dd" } + variable "wef_ami" { - type = "string" + type = "string" default = "ami-03c82482c03a740c5" } + variable "win10_ami" { - type = "string" + type = "string" default = "ami-0a4644e74768900f7" } From 8a3529493e2d2d8cdef1fee2b8f5f7d4113ad84a Mon Sep 17 00:00:00 2001 From: Andrew Svoboda Date: Thu, 23 May 2019 16:25:39 -0700 Subject: [PATCH 2/3] Add terraform fmt check --- .circleci/config.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.circleci/config.yml b/.circleci/config.yml index af01275..87dfda9 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,5 +1,16 @@ version: 2 jobs: + verify: + docker: + - image: circleci/golang:latest + steps: + - checkout + - run: wget -O terraform.zip https://releases.hashicorp.com/terraform/0.11.7/terraform_0.11.7_linux_amd64.zip + - run: unzip terraform.zip + - run: sudo mv terraform /usr/local/bin/terraform + - run: for dir in $(find . -name \*.tf -exec dirname {} \; | sort | uniq); do echo ${dir} && terraform validate -check-variables=false +${dir}; done + - run: terraform fmt -check hold: machine: true steps: @@ -139,7 +150,10 @@ workflows: version: 2 workflow: jobs: + - verify - hold: + requires: + - verify type: approval filters: branches: From ec8b8c5f1bbfef8c64ab236b8dad7693efca72d7 Mon Sep 17 00:00:00 2001 From: Andrew Svoboda Date: Thu, 23 May 2019 16:28:41 -0700 Subject: [PATCH 3/3] fixup circleci config --- .circleci/config.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 87dfda9..43e9974 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -5,12 +5,16 @@ jobs: - image: circleci/golang:latest steps: - checkout - - run: wget -O terraform.zip https://releases.hashicorp.com/terraform/0.11.7/terraform_0.11.7_linux_amd64.zip - - run: unzip terraform.zip - - run: sudo mv terraform /usr/local/bin/terraform - - run: for dir in $(find . -name \*.tf -exec dirname {} \; | sort | uniq); do echo ${dir} && terraform validate -check-variables=false -${dir}; done + - run: + name: Download and Install Terraform + command: | + wget -O terraform.zip https://releases.hashicorp.com/terraform/0.11.7/terraform_0.11.7_linux_amd64.zip + unzip terraform.zip + sudo mv terraform /usr/local/bin/terraform + + - run: for dir in $(find . -name \*.tf -exec dirname {} \; | sort | uniq); do echo ${dir} && terraform validate -check-variables=false ${dir}; done - run: terraform fmt -check + hold: machine: true steps: