Skip to main content
Splunk on AWS without the enterprise sticker shock, and without it running when nobody’s using it.
Language: HCL  ·  Status: active  ·  Last active: this week  ·  Source on GitHub
tofu-splunk-aws provisions an on-demand data-intake environment on AWS. It builds a VPC with a cost-optimized NAT instance. It also runs two independently toggleable workloads, Splunk Enterprise (on by default) and Cribl Stream + Cribl Edge (off by default). It uses plain OpenTofu.

​
What it does

  • Builds an isolated VPC with public/private subnets and a t4g.nano NAT instance in place of a managed NAT Gateway
  • Deploys Splunk Enterprise and/or Cribl Stream/Edge, each behind its own enable_* toggle so a run can bring up either, both, or neither
  • Stops every tagged instance on a nightly schedule via an EventBridge Scheduler that invokes AWS’s built-in stop runbook, with no custom Lambda
  • Starts or stops the whole environment on demand through a GitHub Actions “summon” workflow
  • State locking uses S3’s native conditional-write lockfile; there is no DynamoDB table

​
How it fits

The AWS infrastructure side of Splunk and Cribl, sized to run only when it’s needed. Pair with ansible-splunk for deeper Splunk configuration.

​
Getting started

1

Clone and enter the dev shell

git clone https://github.com/dryvist/tofu-splunk-aws && cd tofu-splunk-aws && nix develop
2

Apply

tofu init -backend-config=envs/dev.s3.tfbackend && tofu apply -var-file=envs/dev.tfvars. Toggle enable_splunk / enable_cribl to choose which workloads come up.
3

Summon it later

Once enable_github_summon = true is applied, start or stop the whole environment from the repo’s Actions tab.

ansible-splunk

Configures the Splunk Enterprise install on what this provisions.

Observability overview

Where this fits in the OTEL → Cribl → Splunk pipeline.

tofu-aws (private)

The broader AWS DR footprint repo this complements. It is private infrastructure with no public source.

Source on GitHub

Modules, env folders, full README.