RELOPS-2530: decommission Splunk Azure IaC (replaced by CrowdStrike NGSIEM) by markcor · Pull Request #325 · mozilla-platform-ops/relops_infra_as_code

markcor · 2026-08-24T16:57:31Z

What

RELOPS-2530 — remove the Splunk log-forwarding infrastructure from the Azure Terraform.

RELOPS-2331 stood up log streaming into SecOps' new SIEM (CrowdStrike Falcon Next-Gen SIEM) via Event Hubs, deliberately keeping the Splunk connection active through the transition. CrowdStrike has now replaced Splunk, so this pipeline is redundant.

The CrowdStrike replacement in azure_infrasec/crowdstrike.tf is untouched by this PR and carries the same 15 Entra log categories, so log coverage is retained. It's also the better-built of the two: it enumerates subscriptions dynamically off the tenant root management group, so new subscriptions onboard automatically. Splunk used a hardcoded list that had already drifted — 0DIN and Fuzzing activity logs were reaching CrowdStrike but not Splunk.

Removed

File	Action
`terraform/azure_fx_nonci/splunk.tf`	deleted — `rg-splunk-eventhub`, the `mozsplunkeventhub` namespace, the `entralogs` and `activitylogs` hubs, the per-subscription activity-log diagnostic settings, and the Entra tenant diagnostic setting
`terraform/azure_ad/sp_splunk.tf`	deleted — `sp-infosec-splunkeventhub` app registration + service principal
`terraform/azure_ad/sp_splunk_logging.tf`	deleted — "Splunk Logging" app registration + service principal
`terraform/azure_ad/rbac.tf`	removed `azurerm_role_assignment.splunkeventhub`
`terraform/azure_fx_nonci/terraform.tfvars`	removed the orphaned `azure_subscriptions` list — its only consumer was `splunk.tf`

grep -rniE splunk across the whole repo now returns nothing.

Deliberately preserved

All three are shared with CrowdStrike, packer or fuzzing — removing them would break unrelated resources:

data.azuread_user.jmoss, declared in sp_packer_worker_images.tf — still used by sp_crowdstrike.tf
data.azuread_group.relops, declared in kitchen-ronin-puppet.tf — still used by fuzzing.tf and sp_firefox_wns.tf
var.azure_subscriptions in azure_ad/rbac.tf — still feeds billing_reader_releng and infrasec_reader

Plans

Pure destroys — nothing added, nothing modified, and no CrowdStrike resource appears in either plan.

Workspace	Result
`terraform/azure_fx_nonci`	0 to add, 0 to change, 10 to destroy
`terraform/azure_ad`	0 to add, 0 to change, 10 to destroy

azure_ad destroys 6 role assignments while azure_fx_nonci destroys 5 diagnostic settings — that asymmetry is the pre-existing coverage drift noted above (azure_ad's list included 0DIN, azure_fx_nonci's did not).

terraform plan — terraform/azure_fx_nonci (0 to add, 0 to change, 10 to destroy)

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # azurerm_eventhub.activitylogs will be destroyed
  # (because azurerm_eventhub.activitylogs is not in configuration)
  - resource "azurerm_eventhub" "activitylogs" {
      - id                  = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub/providers/Microsoft.EventHub/namespaces/mozsplunkeventhub/eventhubs/activitylogs" -> null
      - message_retention   = 7 -> null
      - name                = "activitylogs" -> null
      - namespace_id        = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub/providers/Microsoft.EventHub/namespaces/mozsplunkeventhub" -> null
      - namespace_name      = "mozsplunkeventhub" -> null
      - partition_count     = 2 -> null
      - partition_ids       = [
          - "0",
          - "1",
        ] -> null
      - resource_group_name = "rg-splunk-eventhub" -> null
      - status              = "Active" -> null

      - retention_description {
          - cleanup_policy                    = "Delete" -> null
          - retention_time_in_hours           = 168 -> null
          - tombstone_retention_time_in_hours = 0 -> null
        }
    }

  # azurerm_eventhub.entralogs will be destroyed
  # (because azurerm_eventhub.entralogs is not in configuration)
  - resource "azurerm_eventhub" "entralogs" {
      - id                  = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub/providers/Microsoft.EventHub/namespaces/mozsplunkeventhub/eventhubs/entralogs" -> null
      - message_retention   = 7 -> null
      - name                = "entralogs" -> null
      - namespace_id        = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub/providers/Microsoft.EventHub/namespaces/mozsplunkeventhub" -> null
      - namespace_name      = "mozsplunkeventhub" -> null
      - partition_count     = 2 -> null
      - partition_ids       = [
          - "0",
          - "1",
        ] -> null
      - resource_group_name = "rg-splunk-eventhub" -> null
      - status              = "Active" -> null

      - retention_description {
          - cleanup_policy                    = "Delete" -> null
          - retention_time_in_hours           = 168 -> null
          - tombstone_retention_time_in_hours = 0 -> null
        }
    }

  # azurerm_eventhub_namespace.splunk will be destroyed
  # (because azurerm_eventhub_namespace.splunk is not in configuration)
  - resource "azurerm_eventhub_namespace" "splunk" {
      - auto_inflate_enabled                      = true -> null
      - capacity                                  = 4 -> null
      - default_primary_connection_string         = (sensitive value) -> null
      - default_primary_key                       = (sensitive value) -> null
      - default_secondary_connection_string       = (sensitive value) -> null
      - default_secondary_key                     = (sensitive value) -> null
      - id                                        = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub/providers/Microsoft.EventHub/namespaces/mozsplunkeventhub" -> null
      - local_authentication_enabled              = true -> null
      - location                                  = "eastus2" -> null
      - maximum_throughput_units                  = 4 -> null
      - minimum_tls_version                       = "1.2" -> null
      - name                                      = "mozsplunkeventhub" -> null
      - network_rulesets                          = [
          - {
              - default_action                 = "Allow"
              - ip_rule                        = []
              - public_network_access_enabled  = true
              - trusted_service_access_enabled = false
              - virtual_network_rule           = []
            },
        ] -> null
      - public_network_access_enabled             = true -> null
      - resource_group_name                       = "rg-splunk-eventhub" -> null
      - sku                                       = "Standard" -> null
      - tags                                      = {
          - "owner_email"      = "mcornmesser@mozilla.com"
          - "production_state" = "production"
          - "project_name"     = "azure_fx_nonci"
          - "source_repo_url"  = "https://github.com/mozilla-platform-ops/relops_infra_as_code"
          - "tag_owner_email"  = "infrastructuresecurity@mozilla.com"
          - "terraform"        = "true"
        } -> null
        # (3 unchanged attributes hidden)
    }

  # azurerm_monitor_aad_diagnostic_setting.splunk will be destroyed
  # (because azurerm_monitor_aad_diagnostic_setting.splunk is not in configuration)
  - resource "azurerm_monitor_aad_diagnostic_setting" "splunk" {
      - eventhub_authorization_rule_id = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub/providers/Microsoft.EventHub/namespaces/mozsplunkeventhub/authorizationRules/RootManageSharedAccessKey" -> null
      - eventhub_name                  = "entralogs" -> null
      - id                             = "/providers/Microsoft.AADIAM/diagnosticSettings/splunk-eventhub" -> null
      - name                           = "splunk-eventhub" -> null
        # (2 unchanged attributes hidden)

      - enabled_log {
          - category = "ADFSSignInLogs" -> null
        }
      - enabled_log {
          - category = "AuditLogs" -> null
        }
      - enabled_log {
          - category = "EnrichedOffice365AuditLogs" -> null
        }
      - enabled_log {
          - category = "ManagedIdentitySignInLogs" -> null
        }
      - enabled_log {
          - category = "MicrosoftGraphActivityLogs" -> null
        }
      - enabled_log {
          - category = "NetworkAccessTrafficLogs" -> null
        }
      - enabled_log {
          - category = "NonInteractiveUserSignInLogs" -> null
        }
      - enabled_log {
          - category = "ProvisioningLogs" -> null
        }
      - enabled_log {
          - category = "RemoteNetworkHealthLogs" -> null
        }
      - enabled_log {
          - category = "RiskyServicePrincipals" -> null
        }
      - enabled_log {
          - category = "RiskyUsers" -> null
        }
      - enabled_log {
          - category = "ServicePrincipalRiskEvents" -> null
        }
      - enabled_log {
          - category = "ServicePrincipalSignInLogs" -> null
        }
      - enabled_log {
          - category = "SignInLogs" -> null
        }
      - enabled_log {
          - category = "UserRiskEvents" -> null
        }
    }

  # azurerm_monitor_diagnostic_setting.splunkeventhub["/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec"] will be destroyed
  # (because azurerm_monitor_diagnostic_setting.splunkeventhub is not in configuration)
  - resource "azurerm_monitor_diagnostic_setting" "splunkeventhub" {
      - eventhub_authorization_rule_id = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub/providers/Microsoft.EventHub/namespaces/mozsplunkeventhub/authorizationRules/RootManageSharedAccessKey" -> null
      - eventhub_name                  = "activitylogs" -> null
      - id                             = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec|splunk-eventhub" -> null
      - name                           = "splunk-eventhub" -> null
      - target_resource_id             = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec" -> null
        # (2 unchanged attributes hidden)

      - enabled_log {
          - category       = "Administrative" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Alert" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Policy" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Security" -> null
            # (1 unchanged attribute hidden)
        }
    }

  # azurerm_monitor_diagnostic_setting.splunkeventhub["/subscriptions/108d46d5-fe9b-4850-9a7d-8c914aa6c1f0"] will be destroyed
  # (because azurerm_monitor_diagnostic_setting.splunkeventhub is not in configuration)
  - resource "azurerm_monitor_diagnostic_setting" "splunkeventhub" {
      - eventhub_authorization_rule_id = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub/providers/Microsoft.EventHub/namespaces/mozsplunkeventhub/authorizationRules/RootManageSharedAccessKey" -> null
      - eventhub_name                  = "activitylogs" -> null
      - id                             = "/subscriptions/108d46d5-fe9b-4850-9a7d-8c914aa6c1f0|splunk-eventhub" -> null
      - name                           = "splunk-eventhub" -> null
      - target_resource_id             = "/subscriptions/108d46d5-fe9b-4850-9a7d-8c914aa6c1f0" -> null
        # (2 unchanged attributes hidden)

      - enabled_log {
          - category       = "Administrative" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Alert" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Policy" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Security" -> null
            # (1 unchanged attribute hidden)
        }
    }

  # azurerm_monitor_diagnostic_setting.splunkeventhub["/subscriptions/8a205152-b25a-417f-a676-80465535a6c9"] will be destroyed
  # (because azurerm_monitor_diagnostic_setting.splunkeventhub is not in configuration)
  - resource "azurerm_monitor_diagnostic_setting" "splunkeventhub" {
      - eventhub_authorization_rule_id = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub/providers/Microsoft.EventHub/namespaces/mozsplunkeventhub/authorizationRules/RootManageSharedAccessKey" -> null
      - eventhub_name                  = "activitylogs" -> null
      - id                             = "/subscriptions/8a205152-b25a-417f-a676-80465535a6c9|splunk-eventhub" -> null
      - name                           = "splunk-eventhub" -> null
      - target_resource_id             = "/subscriptions/8a205152-b25a-417f-a676-80465535a6c9" -> null
        # (2 unchanged attributes hidden)

      - enabled_log {
          - category       = "Administrative" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Alert" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Policy" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Security" -> null
            # (1 unchanged attribute hidden)
        }
    }

  # azurerm_monitor_diagnostic_setting.splunkeventhub["/subscriptions/9b9774fb-67f1-45b7-830f-aafe07a94396"] will be destroyed
  # (because azurerm_monitor_diagnostic_setting.splunkeventhub is not in configuration)
  - resource "azurerm_monitor_diagnostic_setting" "splunkeventhub" {
      - eventhub_authorization_rule_id = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub/providers/Microsoft.EventHub/namespaces/mozsplunkeventhub/authorizationRules/RootManageSharedAccessKey" -> null
      - eventhub_name                  = "activitylogs" -> null
      - id                             = "/subscriptions/9b9774fb-67f1-45b7-830f-aafe07a94396|splunk-eventhub" -> null
      - name                           = "splunk-eventhub" -> null
      - target_resource_id             = "/subscriptions/9b9774fb-67f1-45b7-830f-aafe07a94396" -> null
        # (2 unchanged attributes hidden)

      - enabled_log {
          - category       = "Administrative" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Alert" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Policy" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Security" -> null
            # (1 unchanged attribute hidden)
        }
    }

  # azurerm_monitor_diagnostic_setting.splunkeventhub["/subscriptions/a30e97ab-734a-4f3b-a0e4-c51c0bff0701"] will be destroyed
  # (because azurerm_monitor_diagnostic_setting.splunkeventhub is not in configuration)
  - resource "azurerm_monitor_diagnostic_setting" "splunkeventhub" {
      - eventhub_authorization_rule_id = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub/providers/Microsoft.EventHub/namespaces/mozsplunkeventhub/authorizationRules/RootManageSharedAccessKey" -> null
      - eventhub_name                  = "activitylogs" -> null
      - id                             = "/subscriptions/a30e97ab-734a-4f3b-a0e4-c51c0bff0701|splunk-eventhub" -> null
      - name                           = "splunk-eventhub" -> null
      - target_resource_id             = "/subscriptions/a30e97ab-734a-4f3b-a0e4-c51c0bff0701" -> null
        # (2 unchanged attributes hidden)

      - enabled_log {
          - category       = "Administrative" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Alert" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Policy" -> null
            # (1 unchanged attribute hidden)
        }
      - enabled_log {
          - category       = "Security" -> null
            # (1 unchanged attribute hidden)
        }
    }

  # azurerm_resource_group.splunkeventhub will be destroyed
  # (because azurerm_resource_group.splunkeventhub is not in configuration)
  - resource "azurerm_resource_group" "splunkeventhub" {
      - id         = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/resourceGroups/rg-splunk-eventhub" -> null
      - location   = "eastus2" -> null
      - name       = "rg-splunk-eventhub" -> null
      - tags       = {
          - "owner_email"      = "mcornmesser@mozilla.com"
          - "production_state" = "production"
          - "project_name"     = "azure_fx_nonci"
          - "source_repo_url"  = "https://github.com/mozilla-platform-ops/relops_infra_as_code"
          - "tag_owner_email"  = "infrastructuresecurity@mozilla.com"
          - "terraform"        = "true"
        } -> null
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 0 to change, 10 to destroy.

terraform plan — terraform/azure_ad (0 to add, 0 to change, 10 to destroy)

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # azuread_application.splunk_logging will be destroyed
  # (because azuread_application.splunk_logging is not in configuration)
  - resource "azuread_application" "splunk_logging" {
      - app_role_ids                   = {} -> null
      - client_id                      = "31b68eb1-dd36-4317-a95c-9d0e42b18017" -> null
      - device_only_auth_enabled       = false -> null
      - display_name                   = "Splunk Logging" -> null
      - fallback_public_client_enabled = false -> null
      - group_membership_claims        = [] -> null
      - id                             = "/applications/443480b6-0203-45b5-a128-c61633a68e05" -> null
      - identifier_uris                = [] -> null
      - oauth2_permission_scope_ids    = {} -> null
      - oauth2_post_response_required  = false -> null
      - object_id                      = "443480b6-0203-45b5-a128-c61633a68e05" -> null
      - owners                         = [
          - "020e506f-4e41-4007-9117-bcf96fdcae8f",
          - "0f1ed47a-f555-4da9-974a-9506b524a3b9",
          - "4e48c4fe-303d-4d1d-bd6f-76f39f7b1c08",
          - "61d748fa-4254-4686-9a2a-db43814c0f7a",
        ] -> null
      - prevent_duplicate_names        = false -> null
      - publisher_domain               = "mozilla.com" -> null
      - sign_in_audience               = "AzureADMyOrg" -> null
      - tags                           = [] -> null
        # (11 unchanged attributes hidden)

      - api {
          - known_client_applications      = [] -> null
          - mapped_claims_enabled          = false -> null
          - requested_access_token_version = 1 -> null
        }

      - feature_tags {
          - custom_single_sign_on = false -> null
          - enterprise            = false -> null
          - gallery               = false -> null
          - hide                  = false -> null
        }

      - public_client {
          - redirect_uris = [] -> null
        }

      - required_resource_access {
          - resource_app_id = "00000003-0000-0000-c000-000000000000" -> null

          - resource_access {
              - id   = "b0afded3-3588-46d8-8b3d-9842eff778da" -> null
              - type = "Role" -> null
            }
          - resource_access {
              - id   = "df021288-bdef-4463-88db-98f22de89214" -> null
              - type = "Role" -> null
            }
          - resource_access {
              - id   = "38d9df27-64da-44fd-b7c5-a6fbac20248f" -> null
              - type = "Role" -> null
            }
          - resource_access {
              - id   = "381f742f-e1f8-4309-b4ab-e3d91ae4c5c1" -> null
              - type = "Role" -> null
            }
          - resource_access {
              - id   = "e1fe6dd8-ba31-4d61-89e7-88639da4683d" -> null
              - type = "Scope" -> null
            }
          - resource_access {
              - id   = "e4c9e354-4dc5-45b8-9e7c-e1393b0b1a20" -> null
              - type = "Scope" -> null
            }
          - resource_access {
              - id   = "57b030f1-8c35-469c-b0d9-e4a077debe70" -> null
              - type = "Scope" -> null
            }
        }

      - single_page_application {
          - redirect_uris = [] -> null
        }

      - web {
          - redirect_uris = [] -> null
            # (2 unchanged attributes hidden)

          - implicit_grant {
              - access_token_issuance_enabled = false -> null
              - id_token_issuance_enabled     = false -> null
            }
        }
    }

  # azuread_application.splunkeventhub will be destroyed
  # (because azuread_application.splunkeventhub is not in configuration)
  - resource "azuread_application" "splunkeventhub" {
      - app_role_ids                   = {} -> null
      - client_id                      = "0096e9c3-d579-4133-b082-58e7f7f0c905" -> null
      - device_only_auth_enabled       = false -> null
      - display_name                   = "sp-infosec-splunkeventhub" -> null
      - fallback_public_client_enabled = false -> null
      - group_membership_claims        = [] -> null
      - id                             = "/applications/4f0c5d69-839b-4b71-8250-37bfe2a99aaf" -> null
      - identifier_uris                = [] -> null
      - oauth2_permission_scope_ids    = {
          - "user_impersonation" = "c9fd5b23-0534-4627-a9c0-85a5ae79bccf"
        } -> null
      - oauth2_post_response_required  = false -> null
      - object_id                      = "4f0c5d69-839b-4b71-8250-37bfe2a99aaf" -> null
      - owners                         = [
          - "61d748fa-4254-4686-9a2a-db43814c0f7a",
        ] -> null
      - prevent_duplicate_names        = false -> null
      - publisher_domain               = "mozilla.com" -> null
      - sign_in_audience               = "AzureADMyOrg" -> null
      - tags                           = [] -> null
        # (11 unchanged attributes hidden)

      - api {
          - known_client_applications      = [] -> null
          - mapped_claims_enabled          = false -> null
          - requested_access_token_version = 1 -> null

          - oauth2_permission_scope {
              - admin_consent_description  = "Allow the application to access sp-infosec-splunkeventhub on behalf of the signed-in user." -> null
              - admin_consent_display_name = "Access sp-infosec-splunkeventhub" -> null
              - enabled                    = true -> null
              - id                         = "c9fd5b23-0534-4627-a9c0-85a5ae79bccf" -> null
              - type                       = "User" -> null
              - user_consent_description   = "Allow the application to access sp-infosec-splunkeventhub on your behalf." -> null
              - user_consent_display_name  = "Access sp-infosec-splunkeventhub" -> null
              - value                      = "user_impersonation" -> null
            }
        }

      - feature_tags {
          - custom_single_sign_on = false -> null
          - enterprise            = false -> null
          - gallery               = false -> null
          - hide                  = false -> null
        }

      - optional_claims {
        }

      - public_client {
          - redirect_uris = [] -> null
        }

      - single_page_application {
          - redirect_uris = [] -> null
        }

      - web {
          - redirect_uris = [] -> null
            # (2 unchanged attributes hidden)

          - implicit_grant {
              - access_token_issuance_enabled = false -> null
              - id_token_issuance_enabled     = true -> null
            }
        }
    }

  # azuread_service_principal.splunk_logging will be destroyed
  # (because azuread_service_principal.splunk_logging is not in configuration)
  - resource "azuread_service_principal" "splunk_logging" {
      - account_enabled               = true -> null
      - alternative_names             = [] -> null
      - app_role_assignment_required  = false -> null
      - app_role_ids                  = {} -> null
      - app_roles                     = [] -> null
      - application_tenant_id         = "c0dc8bb0-b616-427e-8217-9513964a145b" -> null
      - client_id                     = "31b68eb1-dd36-4317-a95c-9d0e42b18017" -> null
      - display_name                  = "Splunk Logging" -> null
      - id                            = "/servicePrincipals/a84d51f4-a2e3-4fe2-ab8e-e464bcf0f92c" -> null
      - notification_email_addresses  = [] -> null
      - oauth2_permission_scope_ids   = {} -> null
      - oauth2_permission_scopes      = [] -> null
      - object_id                     = "a84d51f4-a2e3-4fe2-ab8e-e464bcf0f92c" -> null
      - owners                        = [] -> null
      - redirect_uris                 = [] -> null
      - service_principal_names       = [] -> null
      - sign_in_audience              = "AzureADMyOrg" -> null
      - tags                          = [] -> null
      - type                          = "Application" -> null
      - use_existing                  = true -> null
        # (7 unchanged attributes hidden)

      - feature_tags {
          - custom_single_sign_on = false -> null
          - enterprise            = false -> null
          - gallery               = false -> null
          - hide                  = false -> null
        }

      - features {
          - custom_single_sign_on_app = false -> null
          - enterprise_application    = false -> null
          - gallery_application       = false -> null
          - visible_to_users          = true -> null
        }

      - saml_single_sign_on {
            # (1 unchanged attribute hidden)
        }
    }

  # azuread_service_principal.splunkeventhub will be destroyed
  # (because azuread_service_principal.splunkeventhub is not in configuration)
  - resource "azuread_service_principal" "splunkeventhub" {
      - account_enabled               = true -> null
      - alternative_names             = [] -> null
      - app_role_assignment_required  = false -> null
      - app_role_ids                  = {} -> null
      - app_roles                     = [] -> null
      - application_tenant_id         = "c0dc8bb0-b616-427e-8217-9513964a145b" -> null
      - client_id                     = "0096e9c3-d579-4133-b082-58e7f7f0c905" -> null
      - display_name                  = "sp-infosec-splunkeventhub" -> null
      - id                            = "/servicePrincipals/2a5a272a-de5d-48d8-9e52-661de9b6280e" -> null
      - notification_email_addresses  = [] -> null
      - oauth2_permission_scope_ids   = {
          - "user_impersonation" = "c9fd5b23-0534-4627-a9c0-85a5ae79bccf"
        } -> null
      - oauth2_permission_scopes      = [
          - {
              - admin_consent_description  = "Allow the application to access sp-infosec-splunkeventhub on behalf of the signed-in user."
              - admin_consent_display_name = "Access sp-infosec-splunkeventhub"
              - enabled                    = true
              - id                         = "c9fd5b23-0534-4627-a9c0-85a5ae79bccf"
              - type                       = "User"
              - user_consent_description   = "Allow the application to access sp-infosec-splunkeventhub on your behalf."
              - user_consent_display_name  = "Access sp-infosec-splunkeventhub"
              - value                      = "user_impersonation"
            },
        ] -> null
      - object_id                     = "2a5a272a-de5d-48d8-9e52-661de9b6280e" -> null
      - owners                        = [] -> null
      - redirect_uris                 = [] -> null
      - service_principal_names       = [] -> null
      - sign_in_audience              = "AzureADMyOrg" -> null
      - tags                          = [] -> null
      - type                          = "Application" -> null
        # (7 unchanged attributes hidden)

      - feature_tags {
          - custom_single_sign_on = false -> null
          - enterprise            = false -> null
          - gallery               = false -> null
          - hide                  = false -> null
        }

      - features {
          - custom_single_sign_on_app = false -> null
          - enterprise_application    = false -> null
          - gallery_application       = false -> null
          - visible_to_users          = true -> null
        }
    }

  # azurerm_role_assignment.splunkeventhub["/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec"] will be destroyed
  # (because azurerm_role_assignment.splunkeventhub is not in configuration)
  - resource "azurerm_role_assignment" "splunkeventhub" {
      - id                                     = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/providers/Microsoft.Authorization/roleAssignments/58b115fc-7193-aa91-35f8-dae03ee6abbd" -> null
      - name                                   = "58b115fc-7193-aa91-35f8-dae03ee6abbd" -> null
      - principal_id                           = "2a5a272a-de5d-48d8-9e52-661de9b6280e" -> null
      - principal_type                         = "ServicePrincipal" -> null
      - role_definition_id                     = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec/providers/Microsoft.Authorization/roleDefinitions/a638d3c7-ab3a-418d-83e6-5f17a39d4fde" -> null
      - role_definition_name                   = "Azure Event Hubs Data Receiver" -> null
      - scope                                  = "/subscriptions/0a420ff9-bc77-4475-befc-a05071fc92ec" -> null
        # (4 unchanged attributes hidden)
    }

  # azurerm_role_assignment.splunkeventhub["/subscriptions/108d46d5-fe9b-4850-9a7d-8c914aa6c1f0"] will be destroyed
  # (because azurerm_role_assignment.splunkeventhub is not in configuration)
  - resource "azurerm_role_assignment" "splunkeventhub" {
      - id                                     = "/subscriptions/108d46d5-fe9b-4850-9a7d-8c914aa6c1f0/providers/Microsoft.Authorization/roleAssignments/92054dba-541b-beee-db45-3ed102059d6b" -> null
      - name                                   = "92054dba-541b-beee-db45-3ed102059d6b" -> null
      - principal_id                           = "2a5a272a-de5d-48d8-9e52-661de9b6280e" -> null
      - principal_type                         = "ServicePrincipal" -> null
      - role_definition_id                     = "/subscriptions/108d46d5-fe9b-4850-9a7d-8c914aa6c1f0/providers/Microsoft.Authorization/roleDefinitions/a638d3c7-ab3a-418d-83e6-5f17a39d4fde" -> null
      - role_definition_name                   = "Azure Event Hubs Data Receiver" -> null
      - scope                                  = "/subscriptions/108d46d5-fe9b-4850-9a7d-8c914aa6c1f0" -> null
        # (4 unchanged attributes hidden)
    }

  # azurerm_role_assignment.splunkeventhub["/subscriptions/8a205152-b25a-417f-a676-80465535a6c9"] will be destroyed
  # (because azurerm_role_assignment.splunkeventhub is not in configuration)
  - resource "azurerm_role_assignment" "splunkeventhub" {
      - id                                     = "/subscriptions/8a205152-b25a-417f-a676-80465535a6c9/providers/Microsoft.Authorization/roleAssignments/58ebb5ee-f4c7-a51f-ce8a-4e49d989953a" -> null
      - name                                   = "58ebb5ee-f4c7-a51f-ce8a-4e49d989953a" -> null
      - principal_id                           = "2a5a272a-de5d-48d8-9e52-661de9b6280e" -> null
      - principal_type                         = "ServicePrincipal" -> null
      - role_definition_id                     = "/subscriptions/8a205152-b25a-417f-a676-80465535a6c9/providers/Microsoft.Authorization/roleDefinitions/a638d3c7-ab3a-418d-83e6-5f17a39d4fde" -> null
      - role_definition_name                   = "Azure Event Hubs Data Receiver" -> null
      - scope                                  = "/subscriptions/8a205152-b25a-417f-a676-80465535a6c9" -> null
        # (4 unchanged attributes hidden)
    }

  # azurerm_role_assignment.splunkeventhub["/subscriptions/9b9774fb-67f1-45b7-830f-aafe07a94396"] will be destroyed
  # (because azurerm_role_assignment.splunkeventhub is not in configuration)
  - resource "azurerm_role_assignment" "splunkeventhub" {
      - id                                     = "/subscriptions/9b9774fb-67f1-45b7-830f-aafe07a94396/providers/Microsoft.Authorization/roleAssignments/db40fcae-6d1b-cb66-19f0-27383d62424b" -> null
      - name                                   = "db40fcae-6d1b-cb66-19f0-27383d62424b" -> null
      - principal_id                           = "2a5a272a-de5d-48d8-9e52-661de9b6280e" -> null
      - principal_type                         = "ServicePrincipal" -> null
      - role_definition_id                     = "/subscriptions/9b9774fb-67f1-45b7-830f-aafe07a94396/providers/Microsoft.Authorization/roleDefinitions/a638d3c7-ab3a-418d-83e6-5f17a39d4fde" -> null
      - role_definition_name                   = "Azure Event Hubs Data Receiver" -> null
      - scope                                  = "/subscriptions/9b9774fb-67f1-45b7-830f-aafe07a94396" -> null
        # (4 unchanged attributes hidden)
    }

  # azurerm_role_assignment.splunkeventhub["/subscriptions/a30e97ab-734a-4f3b-a0e4-c51c0bff0701"] will be destroyed
  # (because azurerm_role_assignment.splunkeventhub is not in configuration)
  - resource "azurerm_role_assignment" "splunkeventhub" {
      - id                                     = "/subscriptions/a30e97ab-734a-4f3b-a0e4-c51c0bff0701/providers/Microsoft.Authorization/roleAssignments/ba138f74-a8ee-792f-c0b8-ab6e4bfb36b8" -> null
      - name                                   = "ba138f74-a8ee-792f-c0b8-ab6e4bfb36b8" -> null
      - principal_id                           = "2a5a272a-de5d-48d8-9e52-661de9b6280e" -> null
      - principal_type                         = "ServicePrincipal" -> null
      - role_definition_id                     = "/subscriptions/a30e97ab-734a-4f3b-a0e4-c51c0bff0701/providers/Microsoft.Authorization/roleDefinitions/a638d3c7-ab3a-418d-83e6-5f17a39d4fde" -> null
      - role_definition_name                   = "Azure Event Hubs Data Receiver" -> null
      - scope                                  = "/subscriptions/a30e97ab-734a-4f3b-a0e4-c51c0bff0701" -> null
        # (4 unchanged attributes hidden)
    }

  # azurerm_role_assignment.splunkeventhub["/subscriptions/e1cb04e4-3788-471a-881f-385e66ad80ab"] will be destroyed
  # (because azurerm_role_assignment.splunkeventhub is not in configuration)
  - resource "azurerm_role_assignment" "splunkeventhub" {
      - id                                     = "/subscriptions/e1cb04e4-3788-471a-881f-385e66ad80ab/providers/Microsoft.Authorization/roleAssignments/cbdf5de3-04c1-3945-c755-b14f86a0a8b0" -> null
      - name                                   = "cbdf5de3-04c1-3945-c755-b14f86a0a8b0" -> null
      - principal_id                           = "2a5a272a-de5d-48d8-9e52-661de9b6280e" -> null
      - principal_type                         = "ServicePrincipal" -> null
      - role_definition_id                     = "/subscriptions/e1cb04e4-3788-471a-881f-385e66ad80ab/providers/Microsoft.Authorization/roleDefinitions/a638d3c7-ab3a-418d-83e6-5f17a39d4fde" -> null
      - role_definition_name                   = "Azure Event Hubs Data Receiver" -> null
      - scope                                  = "/subscriptions/e1cb04e4-3788-471a-881f-385e66ad80ab" -> null
        # (4 unchanged attributes hidden)
    }

Plan: 0 to add, 0 to change, 10 to destroy.

Before applying

This destroys live infrastructure, not just code. Worth confirming first:

SecOps has genuinely retired Splunk ingestion and nothing is still reading from the entralogs / activitylogs hubs.
The "Splunk Logging" app registration predates this repo (created manually in 2023, later imported) and holds Graph application permissions — AuditLog.Read.All, Directory.Read.All, Policy.Read.All, User.Read.All. Terraform cannot see consumers outside Azure, so confirm nothing else authenticates as it.
Apply order does not matter here — the two workspaces have no dependency between them in this change.

Verification

terraform validate and fmt clean on both changed workspaces; azure_fx_nonci now validates with zero warnings, as the deprecation noise came from splunk.tf
all other 26 Terraform workspaces validate unchanged
no dangling references to any deleted resource (checked azuread_service_principal.splunkeventhub, azurerm_eventhub_namespace.splunk, rg-splunk-eventhub, mozsplunkeventhub, sp-infosec-splunkeventhub, and both hardcoded app/scope GUIDs)

Note for reviewers

This should land before #324 (RELOPS-2520). That PR modifies splunk.tf, which this one deletes — it will be rebased to drop its splunk hunk once this merges.

🤖 Generated with Claude Code

CrowdStrike Falcon Next-Gen SIEM has replaced Splunk. RELOPS-2331 stood the CrowdStrike pipeline up alongside Splunk and deliberately kept the Splunk connection active through the transition; that transition is now complete, so the Splunk log-forwarding infrastructure is redundant. Removed: - terraform/azure_fx_nonci/splunk.tf, covering rg-splunk-eventhub, the mozsplunkeventhub Event Hub namespace, the entralogs and activitylogs hubs, the per-subscription activity-log diagnostic settings, and the Entra tenant diagnostic setting - terraform/azure_ad/sp_splunk.tf, the sp-infosec-splunkeventhub app registration and service principal - terraform/azure_ad/sp_splunk_logging.tf, the "Splunk Logging" app registration and service principal - azurerm_role_assignment.splunkeventhub from terraform/azure_ad/rbac.tf - the now-orphaned azure_subscriptions list from terraform/azure_fx_nonci/terraform.tfvars, whose only consumer was splunk.tf Deliberately preserved, since all three are shared with CrowdStrike, packer or fuzzing: data.azuread_user.jmoss, data.azuread_group.relops, and var.azure_subscriptions in azure_ad/rbac.tf, which still feeds billing_reader_releng and infrasec_reader. Plans are pure destroys with no collateral: azure_fx_nonci 0 to add, 0 to change, 10 to destroy azure_ad 0 to add, 0 to change, 10 to destroy Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

jwmossmoz approved these changes Aug 24, 2026

View reviewed changes

markcor merged commit 337986a into master Aug 24, 2026
1 check passed

markcor mentioned this pull request Aug 24, 2026

RELOPS-2520: locked-down on-demand VMs for Desktop Integrations #324

Merged

Navigation Menu

Uh oh!

RELOPS-2530: decommission Splunk Azure IaC (replaced by CrowdStrike NGSIEM) - #325

RELOPS-2530: decommission Splunk Azure IaC (replaced by CrowdStrike NGSIEM)#325
markcor merged 1 commit into
masterfrom
RELOPS-2530-decom-splunk-azure-iac

markcor commented Aug 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

markcor commented Aug 24, 2026

What

Removed

Deliberately preserved

Plans

Before applying

Verification

Note for reviewers

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants