Configuration as Code
CrowdStrike provides a Terraform provider for managing Falcon platform resources and a set of modules for cloud account registration and sensor deployment. Use declarative configuration to enforce security posture, register cloud accounts, and deploy sensors at scale.
Provider
Section titled “Provider”The CrowdStrike Terraform provider manages Falcon platform resources directly — policies, host groups, exclusions, cloud accounts, and more. Over 50 resources and 14 data sources.
Modules
Section titled “Modules”CrowdStrike publishes official Terraform modules on the Terraform Registry for two categories of work: registering cloud accounts with Falcon Cloud Security, and deploying the Falcon sensor to compute workloads.
Cloud Registration
Section titled “Cloud Registration”These modules register your cloud accounts with CrowdStrike Falcon Cloud Security. They provision the IAM roles, service principals, or workload identity resources that allow CrowdStrike to perform asset inventory, real-time visibility, identity protection, and agentless scanning in your environment.
Sensor Deployment
Section titled “Sensor Deployment”These modules deploy the CrowdStrike Falcon sensor to compute workloads. They handle credential storage, package distribution, and operator lifecycle management.
Decision Guide
Section titled “Decision Guide”| I want to… | Module |
|---|---|
| Register an AWS account for cloud security monitoring | AWS Cloud Registration |
| Register an Azure subscription or management group | Azure Cloud Registration |
| Register a GCP organization, folder, or project | GCP Cloud Registration |
| Register an OCI tenancy for cloud security | OCI Cloud Registration |
| Deploy the Falcon sensor to EC2 instances across regions | AWS SSM Distributor |
| Deploy the Falcon sensor to a Kubernetes cluster | Kubernetes |
| Deploy the Falcon sensor to an OpenShift cluster | Kubernetes |
Common Prerequisites
Section titled “Common Prerequisites”All modules require CrowdStrike Falcon API credentials. Create a dedicated API client in the Falcon console under Support and resources > API Clients & Keys. Each module page lists the specific API scopes required.
Credentials are always passed as input variables (falcon_client_id and falcon_client_secret) and should be stored securely — never committed to source control. Use Terraform variables with sensitive = true, environment variables, or a secrets manager.