Skip to main content
Splunk on AWS without the enterprise sticker shock — and without it running when nobody’s using it.
tofu-splunk-aws provisions an on-demand data-ingest environment on AWS: a VPC with a cost-optimized NAT instance, and two independently-toggleable workloads — Splunk Enterprise (on by default) and Cribl Stream + Cribl Edge (off by default). It uses plain OpenTofu.

​
What it does

  • Builds an isolated VPC with public/private subnets and a t4g.nano NAT instance in place of a managed NAT Gateway
  • Deploys Splunk Enterprise and/or Cribl Stream/Edge, each behind its own enable_* toggle so a run can bring up either, both, or neither
  • Stops every tagged instance on a nightly schedule via an EventBridge Scheduler invoking AWS’s built-in stop runbook — no custom Lambda
  • Starts or stops the whole environment on demand through a GitHub Actions “summon” workflow, authenticated by OIDC — no AWS credentials held by the operator
  • State locking uses S3’s native conditional-write lockfile; there is no DynamoDB table

​
How it fits

​
Getting started

1

Clone and enter the dev shell

git clone https://github.com/dryvist/tofu-splunk-aws && cd tofu-splunk-aws && nix develop
2

Provide AWS credentials

Any standard AWS credential source (env vars, SSO, aws-vault) works for the initial tofu apply.
3

Apply

tofu init -backend-config=envs/dev.s3.tfbackend && tofu apply -var-file=envs/dev.tfvars. Toggle enable_splunk / enable_cribl to choose which workload(s) come up.
4

Summon it later without credentials

Once enable_github_summon = true is applied, start or stop the whole environment from the repo’s Actions tab — no AWS credentials needed for that step.

ansible-splunk

Configures the Splunk Enterprise install on what this provisions.

Observability overview

Where this fits in the OTEL → Cribl → Splunk pipeline.

tofu-aws

The broader AWS DR footprint repo this complements.

Source on GitHub

Modules, env folders, full README.