1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

# Deployment for CyberArk Dev Servers ==========================================

module "context" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__shared/context/aws"
  version = "< 1.0"

  stack_name          = "server-stack-cyberark-dev"
  application_name    = "CyberArk"
  project             = "DC-Migration-Project"
  environment         = "dev"
  cost_center_opex    = "271"
  cost_center_capex   = "000"
  data_classification = "internal"
  availability_tier   = "tier-1"
  app_owner           = "Director IT Infrastructure and Platform Engineering"
  team                = "Cybersecurity Operations"
  assignment_group    = "HCA Cybersecurity Identity and Access Management"
  owner               = "[email protected]"
  business_unit       = "Business Supporting Services"

  additional_tags = var.tags
}

module "security_groups" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__networking/security-groups/aws"
  version = "0.1.0"

  name_prefix = "hca-dev-internal"
  vpc_id      = "vpc-0be0292643be78778"

  security_groups = {
    cyberark = {
      name_suffix = "cyberark-sg"
      description = "CyberArk Identity + Connector servers - dev"

      ingress_rules = [
        { description = "RDP from internal network", protocol = "tcp", from_port = 3389, to_port = 3389, ipv4_cidr_blocks = ["172.27.0.0/16"] },
        { description = "CyberArk Vault-to-Connector protocol", protocol = "tcp", from_port = 1858, to_port = 1858, self = true },
        { description = "HTTPS - PVWA and Identity Connector", protocol = "tcp", from_port = 443, to_port = 443, self = true },
        { description = "LDAPS - Identity Connector to AD", protocol = "tcp", from_port = 636, to_port = 636, self = true },
      ]

      egress_rules = [
        { description = "HTTPS outbound - Vault, AD, licensing, updates", protocol = "tcp", from_port = 443, to_port = 443, ipv4_cidr_blocks = ["0.0.0.0/0"] },
        { description = "CyberArk Vault-to-Connector protocol", protocol = "tcp", from_port = 1858, to_port = 1858, self = true },
        { description = "LDAPS to domain controllers", protocol = "tcp", from_port = 636, to_port = 636, ipv4_cidr_blocks = ["172.27.0.0/16"] },
      ]
    }
  }

  tags = module.context.tags
}

module "ec2" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__compute/ec2-node/aws"
  version = "0.6.0"

  name_prefix = "hca-dev-internal"

  instances = {
    for k, v in var.instances : k => merge(v, {
      security_group_ids = [module.security_groups.ids["cyberark"]]
    })
  }

  tags = module.context.tags
}