Splunk Terraform Provider with Cloud SQL Setup

# Define the required providers
terraform {
  required_providers {
    splunk = {
      source = "splunk/splunk"
      version = "1.4.32"
    }
    google = {
      source = "hashicorp/google"
      version = "7.7.0"
    }
  }
}

# Configure the Google provider
provider "google" {
  project     = "my-project-id"
  region      = "us-central1"
}
# Configure the Splunk provider
provider "splunk" {
  url                = "https://your-splunk-instance.com:8089" # Replace with your Splunk management port URL
  username           = "admin"                                 # Replace with your Splunk username
  password           = "your_password"                         # Replace with your Splunk password or use environment variables
  insecure_skip_verify = true                                 # Set to false in production for certificate verification
}

# Example resource: Create or manage a stanza in a configuration file
resource "splunk_configs_conf" "my_custom_stanza" {
  name = "props/my_custom_stanza" # Format: {conf_file_name}/{stanza_name}
  variables = {
    "FIELDALIAS-my_field" = "my_original_field AS new_field_name"
    "TIME_FORMAT"         = "%Y-%m-%d %H:%M:%S"
  }
  acl {
    owner = "nobody" # Or specify a specific user
    app   = "search" # Or specify a specific app
  }
}

# Create a Cloud SQL Instance
resource "google_sql_database_instance" "default" {
  name             = "sql-instance-with-logging"
  database_version = "MYSQL_8_0"
  region           = "us-central1"

  settings {
    tier = "db-f1-micro"

    backup_configuration {
      enabled            = true
      binary_log_enabled = true
    }

    database_flags {
      name  = "log_output"
      value = "FILE,SYSLOG"
    }
    database_flags {
      name  = "general_log"
      value = "On"
    }
    database_flags {
      name  = "slow_query_log"
      value = "On"
    }
  }
}

# Create a Pub/Sub Topic
resource "google_pubsub_topic" "default" {
  name = "psql-audit-splunk"
}

variable "project_id" {
  type        = string
  description = "The ID of the project to create the sink in."
}

# Create the log router sink from Cloud SQL database to the Pub/Sub Topic
resource "google_logging_project_sink" "default" {
  name        = "psql-audit-sink"
  destination = "pubsub.googleapis.com/projects/${var.project_id}/topics/${google_pubsub_topic.default.name}"
  filter      = "resource.type=\"cloudsql_database\" resource.labels.database_id=\"gcp-appdcloudplatfo-nprd-68190:splunk-psql\" " #Example Filter, Replace with your actual inclusion filter
}


# Create a Service Account for Splunk Add-on Configuration
resource "google_service_account" "splunk_sa" {
  account_id   = "splunk-sa"
  display_name = "Splunk Service Account"
  description  = "Service account for Splunk integration"
}

resource "google_service_account_iam_binding" "cloud_sql_admin" {
  service_account_id = google_service_account.splunk_sa.name
  role               = "roles/cloudsql.admin"
  members = [
    "serviceAccount:${google_service_account.splunk_sa.email}",
  ]
}

resource "google_service_account_iam_binding" "monitoring_viewer" {
  service_account_id = google_service_account.splunk_sa.name
  role               = "roles/monitoring.viewer"
  members = [
    "serviceAccount:${google_service_account.splunk_sa.email}",
  ]
}

resource "google_service_account_iam_binding" "pubsub_subscriber" {
  service_account_id = google_service_account.splunk_sa.name
  role               = "roles/pubsub.subscriber"
  members = [
    "serviceAccount:${google_service_account.splunk_sa.email}",
  ]
}

resource "google_service_account_iam_binding" "pubsub_viewer" {
  service_account_id = google_service_account.splunk_sa.name
  role               = "roles/pubsub.viewer"
  members = [
    "serviceAccount:${google_service_account.splunk_sa.email}",
  ]
}

# Install the Splunk Add-on for Google Cloud Platform
#   Either from Splunkbase URL with auth token, or from local directory
resource "splunk_app" "gcp_addon" {
  name = "https://splunkbase.splunk.com/app/3088" # The directory name of the app after installation
  filename = false # Install from Splunkbase, or set to True, and change name to local path to app package
  auth = "" # Splunkbase session token
}
# Create a Service Account
resource "splunk_configs_conf" "gcp_service_account" {
  name = "inputs.conf/cloudsql_input"
  acl {
    app = "Splunk_TA_google-cloudplatform"
  }
  variables = {
    google_credentials_name = "service_account_name_as_configured_in_splunk"
    google_project = "gcp-appdcloudplatfo-nprd-id"
    google_subscriptions = "psql-audit-splunk-sub"
    index = "cloudsql-auditlog"
    sourcetype = "google:gcp:pubsub:message"
  }
}

# Create the modular input
resource "splunk_configs_conf" "cloudsql_input" {
  name = "inputs.conf/cloudsql_input"
  acl {
    app = "Splunk_TA_google-cloudplatform"
  }
  variables = {
    google_credentials_name = "${splunk_configs_conf.gcp_service_account.name}"
    google_project = "gcp-appdcloudplatfo-nprd-id"
    google_subscriptions = "psql-audit-splunk-sub"
    index = "cloudsql-auditlog"
    sourcetype = "google:gcp:pubsub:message"
  }
}