Skip to content

Commit f7ed682

Browse files
ffalorffalor
authored
add crowdstrike_cloud_group resource (#190)
1 parent bce1250 commit f7ed682

File tree

10 files changed

+2685
-0
lines changed

10 files changed

+2685
-0
lines changed

‎docs/resources/cloud_group.md‎

Lines changed: 265 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,265 @@
1+
---
2+
page_title: "crowdstrike_cloud_group Resource - crowdstrike"
3+
subcategory: "Falcon Cloud Security"
4+
description: |-
5+
This resource manages CrowdStrike Cloud Groups for organizing cloud resources and container images.
6+
API Scopes
7+
The following API scopes are required:
8+
Cloud security | Read & Write
9+
---
10+
11+
# crowdstrike_cloud_group (Resource)
12+
13+
This resource manages CrowdStrike Cloud Groups for organizing cloud resources and container images.
14+
15+
## API Scopes
16+
17+
The following API scopes are required:
18+
19+
- Cloud security | Read & Write
20+
21+
22+
## Example Usage
23+
24+
```terraform
25+
terraform {
26+
required_providers {
27+
crowdstrike = {
28+
source = "crowdstrike/crowdstrike"
29+
}
30+
}
31+
}
32+
33+
provider "crowdstrike" {
34+
cloud = "us-1"
35+
}
36+
37+
# AWS cloud group with filters
38+
resource "crowdstrike_cloud_group" "aws_production" {
39+
name = "Production AWS Resources"
40+
description = "Production AWS accounts in us-east-1 and us-west-2"
41+
business_impact = "high"
42+
business_unit = "Engineering"
43+
environment = "prod"
44+
owners = ["[email protected]", "[email protected]"]
45+
46+
aws = {
47+
account_ids = ["123456789012", "234567890123"]
48+
filters = {
49+
region = ["us-east-1", "us-west-2"]
50+
tags = ["Environment=Production", "Team=Platform"]
51+
}
52+
}
53+
}
54+
55+
# Multi-cloud group
56+
resource "crowdstrike_cloud_group" "multi_cloud_dev" {
57+
name = "Development Multi-Cloud"
58+
description = "Development resources across AWS, Azure, and GCP"
59+
business_impact = "moderate"
60+
environment = "dev"
61+
62+
aws = {
63+
account_ids = ["987654321098"]
64+
filters = {
65+
region = ["us-east-1"]
66+
}
67+
}
68+
69+
azure = {
70+
account_ids = ["a1b2c3d4-e5f6-7890-abcd-ef1234567890"]
71+
filters = {
72+
region = ["eastus"]
73+
tags = ["Environment=Dev"]
74+
}
75+
}
76+
77+
gcp = {
78+
account_ids = ["my-gcp-project-id"]
79+
filters = {
80+
region = ["us-central1"]
81+
}
82+
}
83+
}
84+
85+
# Container image group
86+
resource "crowdstrike_cloud_group" "container_images" {
87+
name = "Production Container Images"
88+
description = "Production container images from various registries"
89+
environment = "prod"
90+
91+
images = [
92+
{
93+
registry = "docker.io"
94+
repositories = ["myorg/backend-api"]
95+
tags = ["v1.2.3"]
96+
},
97+
{
98+
registry = "ghcr.io"
99+
repositories = ["myorg/frontend"]
100+
tags = ["latest"]
101+
},
102+
{
103+
registry = "123456789012.dkr.ecr.us-east-1.amazonaws.com"
104+
repositories = ["internal/worker"]
105+
}
106+
]
107+
}
108+
109+
# Azure-only group with minimal configuration
110+
resource "crowdstrike_cloud_group" "azure_simple" {
111+
name = "Azure Subscriptions"
112+
113+
azure = {
114+
account_ids = [
115+
"a1b2c3d4-e5f6-7890-abcd-ef1234567890",
116+
"b2c3d4e5-f6a7-8901-bcde-f12345678901"
117+
]
118+
}
119+
}
120+
121+
# GCP group (note: GCP does not support tag filtering)
122+
resource "crowdstrike_cloud_group" "gcp_projects" {
123+
name = "GCP Projects"
124+
description = "All GCP projects for data analytics"
125+
business_unit = "Data Analytics"
126+
business_impact = "moderate"
127+
128+
gcp = {
129+
account_ids = ["analytics-project-prod", "analytics-project-staging"]
130+
filters = {
131+
region = ["us-central1", "us-east1", "global", "us"]
132+
}
133+
}
134+
}
135+
136+
# Multi-cloud group managing all accounts with selective filters
137+
resource "crowdstrike_cloud_group" "all_clouds_filtered" {
138+
name = "All Cloud Accounts - Production Only"
139+
description = "Access to all accounts across clouds, filtered by production tags"
140+
business_impact = "high"
141+
environment = "prod"
142+
143+
aws = {
144+
filters = {
145+
region = ["us-east-1", "us-west-2", "eu-west-1"]
146+
tags = ["Environment=Production", "ManagedBy=Terraform"]
147+
}
148+
}
149+
150+
azure = {
151+
filters = {
152+
region = ["eastus", "westus", "westeurope"]
153+
tags = ["Environment=Production"]
154+
}
155+
}
156+
157+
gcp = {
158+
filters = {
159+
region = ["us-central1", "us-east1", "europe-west1"]
160+
}
161+
}
162+
}
163+
```
164+
165+
<!-- schema generated by tfplugindocs -->
166+
## Schema
167+
168+
### Required
169+
170+
- `name` (String) The name of the cloud group.
171+
172+
### Optional
173+
174+
- `aws` (Attributes) AWS cloud resource configuration (see [below for nested schema](#nestedatt--aws))
175+
- `azure` (Attributes) Azure cloud resource configuration (see [below for nested schema](#nestedatt--azure))
176+
- `business_impact` (String) An impact level that reflects how critical the cloud group's assets are to business operations. Valid values: high, moderate, low.
177+
- `business_unit` (String) A free-text label used to associate the cloud group with an internal team.
178+
- `description` (String) The description of the cloud group.
179+
- `environment` (String) Environment designation for the group. Valid values: dev, test, stage, prod.
180+
- `gcp` (Attributes) GCP cloud resource configuration (see [below for nested schema](#nestedatt--gcp))
181+
- `images` (Attributes List) The container images accessible to the group. Each entry includes a registry and filters for repositories and tags. (see [below for nested schema](#nestedatt--images))
182+
- `owners` (List of String) Contact information for stakeholders responsible for the cloud group. List of email addresses.
183+
184+
### Read-Only
185+
186+
- `created_at` (String) The timestamp when the group was created.
187+
- `created_by` (String) The API client ID that created the group.
188+
- `id` (String) The ID of the cloud group.
189+
- `last_updated` (String) The timestamp when the group was last updated.
190+
191+
<a id="nestedatt--aws"></a>
192+
### Nested Schema for `aws`
193+
194+
Optional:
195+
196+
- `account_ids` (List of String) The cloud account identifiers (AWS account IDs) to include in the group. This field limits access to cloud resources in the specified accounts. When not provided, resources across all accounts in the cloud provider are accessible to the group.
197+
- `filters` (Attributes) Filters for AWS cloud resources (see [below for nested schema](#nestedatt--aws--filters))
198+
199+
<a id="nestedatt--aws--filters"></a>
200+
### Nested Schema for `aws.filters`
201+
202+
Optional:
203+
204+
- `region` (List of String) List of AWS regions to include
205+
- `tags` (List of String) List of tags to filter by (format: key=value)
206+
207+
208+
209+
<a id="nestedatt--azure"></a>
210+
### Nested Schema for `azure`
211+
212+
Optional:
213+
214+
- `account_ids` (List of String) The cloud account identifiers (Azure subscription IDs) to include in the group. This field limits access to cloud resources in the specified accounts. When not provided, resources across all accounts in the cloud provider are accessible to the group.
215+
- `filters` (Attributes) Filters for Azure cloud resources (see [below for nested schema](#nestedatt--azure--filters))
216+
217+
<a id="nestedatt--azure--filters"></a>
218+
### Nested Schema for `azure.filters`
219+
220+
Optional:
221+
222+
- `region` (List of String) List of Azure regions to include
223+
- `tags` (List of String) List of tags to filter by (format: key=value)
224+
225+
226+
227+
<a id="nestedatt--gcp"></a>
228+
### Nested Schema for `gcp`
229+
230+
Optional:
231+
232+
- `account_ids` (List of String) The cloud account identifiers (GCP project IDs) to include in the group. This field limits access to cloud resources in the specified accounts. When not provided, resources across all accounts in the cloud provider are accessible to the group.
233+
- `filters` (Attributes) Filters for GCP cloud resources. Note: GCP does not support tag filtering. (see [below for nested schema](#nestedatt--gcp--filters))
234+
235+
<a id="nestedatt--gcp--filters"></a>
236+
### Nested Schema for `gcp.filters`
237+
238+
Optional:
239+
240+
- `region` (List of String) List of GCP regions to include
241+
242+
243+
244+
<a id="nestedatt--images"></a>
245+
### Nested Schema for `images`
246+
247+
Required:
248+
249+
- `registry` (String) The container registry to include in the group. Must be a complete HTTPS URL for a supported registry. For info about supported registries and URL format, see https://docs.crowdstrike.com/r/ved836f1
250+
251+
Optional:
252+
253+
- `repositories` (List of String) The container image repositories within the specified registry to filter by. When specified, only images within these repositories are accessible to the group. When omitted, all repositories in the registry are included.
254+
- `tags` (List of String) The container image tags to filter by. Tag matching is scoped to the specified repositories values, or across all repositories in the given registry if repositories are not provided.
255+
256+
## Import
257+
258+
Import is supported using the following syntax:
259+
260+
```shell
261+
#!/bin/bash
262+
263+
# Import an existing cloud group by its UUID
264+
terraform import crowdstrike_cloud_group.aws_production "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
265+
```

‎examples/resources/crowdstrike_cloud_group/import.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/bash
2+
3+
# Import an existing cloud group by its UUID
4+
terraform import crowdstrike_cloud_group.aws_production "a1b2c3d4-e5f6-7890-abcd-ef1234567890"

0 commit comments

Comments
 (0)