adding collectors and s3 sources for corelight and umbrella (SumoLogi…

…c#188)

* addomg collectors and s3 sources for corelight and umbrella

* fix formatting

* reference the module

* reference the module

* add output to module

* fix formatting

modules/collector/outputs.tf

@@ -9,3 +9,7 @@ output "search_filter" {
 output "source_category" {
   value = [for src in sumologic_http_source.sources : src.category]
 }
+
+output "sumologic_collector_id" {
+  value = sumologic_collector.collector.id
+}

terraform/collectors.tf

@@ -245,3 +245,19 @@ module "nytimes-dv-awsma-drone" {
   name = "nytimes/dv-awsma-drone"
   env  = var.env
 }
+
+# Corelight logs - no associated repo
+module "nytimes-infosec-corelight" {
+  source = "../modules/collector"
+
+  name = "nytimes-infosec-corelight"
+  env  = var.env
+}
+
+# Umbrella logs - no associated repo
+module "nytimes-infosec-umbrella" {
+  source = "../modules/collector"
+
+  name = "nytimes-infosec-umbrella"
+  env  = var.env
+}

terraform/infosec-corelight.tf

@@ -0,0 +1,20 @@
+resource "sumologic_s3_source" "infosec-corelight" {
+  name          = "Corelight Logs"
+  description   = "Log files from Corelight appliances"
+  category      = "aws/s3"
+  content_type  = "AwsS3Bucket"
+  scan_interval = 300000
+  paused        = false
+  collector_id  = module.nytimes-infosec-corelight.sumologic_collector_id
+
+  authentication {
+    type     = "AWSRoleBasedAuthentication"
+    role_arn = "arn:aws:iam::550861604386:role/nyt-sumo-corelight-role"
+  }
+
+  path {
+    type            = "S3BucketPathExpression"
+    bucket_name     = "infosec-corelight-51347c84"
+    path_expression = "*"
+  }
+}

terraform/infosec-umbrella.tf

@@ -0,0 +1,20 @@
+resource "sumologic_s3_source" "infosec-umbrella" {
+  name          = "umbrella Logs"
+  description   = "Log files from umbrella appliances"
+  category      = "aws/s3"
+  content_type  = "AwsS3Bucket"
+  scan_interval = 300000
+  paused        = false
+  collector_id  = module.nytimes-infosec-umbrella.sumologic_collector_id
+
+  authentication {
+    type     = "AWSRoleBasedAuthentication"
+    role_arn = "arn:aws:iam::147536899606:role/umbrella-sumo-ingest-role"
+  }
+
+  path {
+    type            = "S3BucketPathExpression"
+    bucket_name     = "infosec-dev-umbrella-logs"
+    path_expression = "*"
+  }
+}