susin0811/es-splunk

Purpose and Entry Points

This repository is an infrastructure-as-code package that deploys a distributed Splunk Enterprise 9.3 / Enterprise Security environment on AWS. Terraform is the primary control plane: terraform/main.tf composes the deployment, while scripts/deploy.sh and scripts/deploy.ps1 wrap Terraform plan/apply/output workflows. Post-provisioning operations use scripts/install-es-app.sh and scripts/health-check.sh.

Root Composition and Configuration Boundary

terraform/main.tf wires VPC, security, S3, and Splunk compute modules into one AWS stack. Inputs—including region, EC2 key pair, Splunk artifact URI, admin password, CIDR restrictions, SmartStore, ALB, and bastion toggles—are defined in terraform/variables.tf; exported access endpoints and deployment metadata are in terraform/outputs.tf. terraform/terraform.tfvars.example is the operator-facing configuration template.

Network and Access Layer

The VPC module establishes the isolated AWS network, including subnets and NAT routing, in terraform/modules/vpc/main.tf. Security groups and permitted Splunk/UI/management traffic are defined in terraform/modules/security/main.tf. Splunk nodes are intended to remain private; a bastion and optional ALB provide controlled administrative or web entry paths.

Storage and Artifact Layer

terraform/modules/s3/main.tf creates private S3 storage for two distinct concerns: Splunk installation artifacts and SmartStore-backed data tiers. The deployment consumes an externally supplied Splunk Enterprise tarball URI, so artifact upload/prestaging is an operator responsibility. AWS IAM permissions created by the compute module allow Splunk infrastructure to access these buckets.

Splunk Compute Topology

terraform/modules/splunk/main.tf provisions the EC2/IAM/optional ALB layer for the distributed deployment:

• Search Head: Splunk Web, search processing, and Enterprise Security runtime.

• Two indexers: ingestion and replicated/searchable data storage, configured for RF=2 and SF=2.

• Cluster Manager combined with Deployment Server: indexer-cluster coordination plus app/config distribution.

• Optional bastion access and ALB exposure are infrastructure-level features of this layer.

AWS EC2, EBS, IAM, Secrets Manager, S3, VPC, and optionally ALB are material runtime dependencies.

Bootstrap and Cluster Formation

EC2 user-data templates install and configure Splunk during instance initialization. terraform/modules/splunk/templates/user-data-cluster-manager.sh.tpl establishes the cluster-management/deployment-server role; terraform/modules/splunk/templates/user-data-indexer.sh.tpl connects indexers to that manager and applies clustered-storage setup; terraform/modules/splunk/templates/user-data-search-head.sh.tpl configures the Search Head to operate against the indexer tier. Bootstrap failures are surfaced through instance-side logs rather than an application runtime in this repository.

Operational Lifecycle and External Boundaries

Terraform provisions only Splunk Enterprise infrastructure; Enterprise Security itself is separately licensed and supplied as an external .spl/.tgz package. scripts/install-es-app.sh performs the post-deployment ES installation through the deployed environment, after which operators license and configure ES in Splunk Web. scripts/health-check.sh validates the reachable cluster after bootstrap. AWS credentials, a preexisting EC2 key pair, Splunk binaries, licenses, and the ES package remain external prerequisites.