> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jacobpevans.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Splunk on AWS
> Plain OpenTofu for an on-demand Splunk and/or Cribl environment on AWS. Both workloads are independently optional, the whole stack auto-stops on a schedule, and it starts and stops again through a credential-less GitHub Actions "summon" workflow.
export const RepoFit = ({children}) => {children};
export const RepoMeta = ({language, status, lastActive, repoUrl}) =>
Language: {language} · Status: {status} · Last active: {lastActive} · Source on GitHub
;
> Splunk on AWS without the enterprise sticker shock — and without it running when nobody's using it.
`tofu-splunk-aws` provisions an on-demand data-ingest environment on AWS: a VPC with a cost-optimized NAT instance, and two independently-toggleable workloads — Splunk Enterprise (on by default) and Cribl Stream + Cribl Edge (off by default). It uses plain OpenTofu.
## What it does
* Builds an isolated VPC with public/private subnets and a t4g.nano NAT instance in place of a managed NAT Gateway
* Deploys Splunk Enterprise and/or Cribl Stream/Edge, each behind its own `enable_*` toggle so a run can bring up either, both, or neither
* Stops every tagged instance on a nightly schedule via an EventBridge Scheduler invoking AWS's built-in stop runbook — no custom Lambda
* Starts or stops the whole environment on demand through a GitHub Actions "summon" workflow, authenticated by OIDC — no AWS credentials held by the operator
* State locking uses S3's native conditional-write lockfile; there is no DynamoDB table
## How it fits
| Provisions | Hands off to |
| --------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| AWS VPC, NAT instance, Splunk and/or Cribl EC2 instances, IAM, SSM-stored secrets | [Splunk install (Ansible)](/observability/repos/ansible-splunk) configures Splunk further where applicable |
The AWS infrastructure side of Splunk and Cribl, sized to run only when it's needed. Pair with `ansible-splunk` for deeper Splunk configuration.
## Getting started
`git clone https://github.com/dryvist/tofu-splunk-aws && cd tofu-splunk-aws && nix develop`
Any standard AWS credential source (env vars, SSO, aws-vault) works for the initial `tofu apply`.
`tofu init -backend-config=envs/dev.s3.tfbackend && tofu apply -var-file=envs/dev.tfvars`. Toggle `enable_splunk` / `enable_cribl` to choose which workload(s) come up.
Once `enable_github_summon = true` is applied, start or stop the whole environment from the repo's Actions tab — no AWS credentials needed for that step.
## Related repos
Configures the Splunk Enterprise install on what this provisions.
Where this fits in the OTEL → Cribl → Splunk pipeline.
The broader AWS DR footprint repo this complements.
Modules, env folders, full README.