# GCP Cloud Registration

This Terraform module provides automated registration and configuration of Google Cloud Platform (GCP) organizations, folders, and projects with CrowdStrike's Cloud Security Posture Management (CSPM) platform. The module enables keyless authentication through GCP's Workload Identity Federation and provides security monitoring capabilities including asset inventory and optional real-time log ingestion for threat detection.

### Key Features

- **Multi-Scope Registration**: Support for organization, folder, and project-level registrations
- **Workload Identity Federation**: Secure, keyless authentication using GCP's identity federation  
- **Asset Inventory**: Monitoring of GCP resources for security posture assessment
- **Real Time Visibility & Detection** (Optional): Real-time log streaming for threat detection

### Architecture Overview

The module creates the following GCP resources:
- Workload Identity Pool and Provider for authentication
- IAM role bindings for CrowdStrike service principals across target scopes
- Pub/Sub topics and subscriptions for log ingestion (when RTV&D is enabled)
- Log sinks for audit log streaming (when RTV&D is enabled)

### Prerequisites

Before using this module, ensure you have:

1. **CrowdStrike Requirements**:
   - Falcon Console access with CSPM enabled
   - API credentials with `CSPM registration (Read & Write)` and `Cloud Security Google Cloud Registration (Read & Write)` scopes

2. **GCP Requirements**:
   - GCP project for CrowdStrike infrastructure resources
   - Appropriate IAM permissions for the deployment service account
   - Required GCP APIs enabled

## Usage

```hcl
terraform {
  required_version = ">= 1.5.0"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = ">= 6.22"
    }
  }
}

provider "google" {
  project = "your-csmp-infrastructure-project"
}

module "crowdstrike_gcp_registration" {
  source = "CrowdStrike/terraform-google-cloud-registration"
  falcon_client_id     = "<Falcon API client ID>"
  falcon_client_secret = "<Falcon API client secret>"

  # GCP Infrastructure Project
  infra_project_id = "your-csmp-infrastructure-project"

  # Registration Scope - Organization Level
  registration_type = "organization"
  organization_id   = "123456789012"

  # CrowdStrike Role ARN
  role_arn = "arn:aws:sts::111111111111:assumed-role/CrowdStrikeConnectorRoleName"

  # Optional: Enable Real Time Visibility & Detection
  enable_realtime_visibility = true

  # Optional: Log Ingestion Configuration
  log_ingestion_settings = {
    message_retention_duration       = "1209600s"  # 14 days
    ack_deadline_seconds             = 300         # 5 minutes
    topic_message_retention_duration = "2592000s"  # 30 days
    audit_log_types                  = ["activity", "system_event", "policy"]
    exclusion_filters = [
      "resource.labels.environment=\"test\"",
      "resource.labels.temporary=\"true\""
    ]
  }

  # Optional: Resource Naming
  resource_prefix = "cs-"
  resource_suffix = "-prod"

  # Optional: Resource Labels
  labels = {
    environment = "production"
    project     = "crowdstrike-integration"
    cstagvendor = "crowdstrike"
  }
}
```

## Providers

| Name | Version |
|------|---------|
|  [crowdstrike](#provider\_crowdstrike) | >= 0.0.88 |
|  [google](#provider\_google) | >= 6.22 |
## Resources

| Name | Type |
|------|------|
| [crowdstrike_cloud_google_registration.main](https://registry.terraform.io/providers/crowdstrike/crowdstrike/latest/docs/resources/cloud_google_registration) | resource |
| [crowdstrike_cloud_google_registration_settings.main](https://registry.terraform.io/providers/crowdstrike/crowdstrike/latest/docs/resources/cloud_google_registration_settings) | resource |
| [google_project.wif_project](https://registry.terraform.io/providers/hashicorp/google/latest/docs/data-sources/project) | data source |
## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
|  [agentless\_scanning\_role\_arn](#input\_agentless\_scanning\_role\_arn) | AWS Role ARN used by CrowdStrike agentless scanning for authentication via WIF. Required when agentless scanning is enabled and role\_arn is set. | `string` | `null` | no |
|  [agentless\_scanning\_service\_account\_unique\_id](#input\_agentless\_scanning\_service\_account\_unique\_id) | Numeric unique ID of CrowdStrike's agentless scanning service account. Required when agentless scanning is enabled and service\_account\_unique\_id is set. | `string` | `null` | no |
|  [agentless\_scanning\_settings](#input\_agentless\_scanning\_settings) | Configuration settings for agentless scanning infrastructure. Controls scanning scope, VPC, and network settings. | <pre>object({<br/>    host_project_id  = optional(string)<br/>    org_id           = optional(string)<br/>    regions          = optional(set(string), [])<br/>    deploy_cloud_nat = optional(bool, true)<br/>    custom_vpc_configuration = optional(object({<br/>      vpc_name = string<br/>      subnets  = map(string)<br/>    }))<br/>  })</pre> | `{}` | no |
|  [deployment\_method](#input\_deployment\_method) | Deployment method for the CrowdStrike GCP registration | `string` | `"terraform-native"` | no |
|  [enable\_dspm](#input\_enable\_dspm) | Enable DSPM agentless scanning infrastructure | `bool` | `false` | no |
|  [enable\_realtime\_visibility](#input\_enable\_realtime\_visibility) | Enable Real Time Visibility and Detection (RTV&D) features via log ingestion | `bool` | `false` | no |
|  [enable\_vulnerability\_scanning](#input\_enable\_vulnerability\_scanning) | Enable agentless vulnerability scanning infrastructure | `bool` | `false` | no |
|  [excluded\_project\_patterns](#input\_excluded\_project\_patterns) | List of shell-style patterns to exclude specific projects from CSPM registration. Supports wildcards (* and ?). Projects matching these patterns will be excluded from asset inventory and log ingestion. Examples: 'sys-*', 'dev-?'. | `list(string)` | `[]` | no |
|  [existing\_wif\_pool\_id](#input\_existing\_wif\_pool\_id) | The ID of an existing GCP Workload Identity Pool, created by another registration under the same CID, to attach this registration to instead of creating a new pool. The CrowdStrike backend resolves the owner registration's WIF settings for this registration. Mutually exclusive with wif\_project\_id. Only supported when registration\_type = "project"; not compatible with enable\_realtime\_visibility, enable\_dspm, or enable\_vulnerability\_scanning. | `string` | `null` | no |
|  [falcon\_client\_id](#input\_falcon\_client\_id) | Falcon API client ID. | `string` | `null` | no |
|  [falcon\_client\_secret](#input\_falcon\_client\_secret) | Falcon API client secret. | `string` | `null` | no |
|  [folder\_ids](#input\_folder\_ids) | List of Google Cloud folders being registered. When enable\_dspm = true, all folders must reside in the same organization. | `list(string)` | `[]` | no |
|  [infra\_project\_id](#input\_infra\_project\_id) | Google Cloud Project ID where CrowdStrike infrastructure resources will be deployed. | `string` | n/a | yes |
|  [infrastructure\_manager\_region](#input\_infrastructure\_manager\_region) | The Google Cloud region for Infrastructure Manager. Required when deployment\_method is infrastructure-manager | `string` | `null` | no |
|  [labels](#input\_labels) | Map of labels to be applied to all resources created by this module | `map(string)` | `{}` | no |
|  [log\_ingestion\_settings](#input\_log\_ingestion\_settings) | Configuration settings for log ingestion. Controls Pub/Sub topic and subscription settings, audit log types, schema validation, and allows using existing resources. | <pre>object({<br/>    message_retention_duration       = optional(string, "604800s")<br/>    ack_deadline_seconds             = optional(number, 600)<br/>    topic_message_retention_duration = optional(string, "604800s")<br/>    audit_log_types                  = optional(list(string), ["activity", "system_event", "policy"])<br/>    topic_storage_regions            = optional(list(string), [])<br/>    enable_schema_validation         = optional(bool, false)<br/>    schema_type                      = optional(string, "AVRO")<br/>    schema_definition                = optional(string)<br/>    existing_topic_name              = optional(string)<br/>    existing_subscription_name       = optional(string)<br/>    exclusion_filters                = optional(list(string), [])<br/>  })</pre> | `{}` | no |
|  [organization\_id](#input\_organization\_id) | GCP Organization ID for organization-level registration | `string` | `null` | no |
|  [project\_ids](#input\_project\_ids) | List of Google Cloud projects being registered | `list(string)` | `[]` | no |
|  [registration\_name](#input\_registration\_name) | Name for the CrowdStrike GCP registration | `string` | n/a | yes |
|  [registration\_type](#input\_registration\_type) | Type of registration: organization, folder, or project | `string` | n/a | yes |
|  [resource\_prefix](#input\_resource\_prefix) | Prefix to be added to all created resource names for identification. Combined length of prefix + suffix must not exceed 13 characters. | `string` | `null` | no |
|  [resource\_suffix](#input\_resource\_suffix) | Suffix to be added to all created resource names for identification. Combined length of prefix + suffix must not exceed 13 characters. | `string` | `null` | no |
|  [role\_arn](#input\_role\_arn) | AWS Role ARN used by CrowdStrike for authentication. Required when CrowdStrike authenticates via AWS STS. Mutually exclusive with service\_account\_unique\_id. | `string` | `null` | no |
|  [service\_account\_unique\_id](#input\_service\_account\_unique\_id) | Numeric unique ID of CrowdStrike's shared service account. Required when CrowdStrike authenticates via GCP OIDC. Mutually exclusive with role\_arn. | `string` | `null` | no |
|  [wif\_project\_id](#input\_wif\_project\_id) | Google Cloud Project ID where the CrowdStrike workload identity federation pool resources are deployed. Defaults to infra\_project\_id if not specified. Must not be set when existing\_wif\_pool\_id is set; the two are mutually exclusive. | `string` | `null` | no |
## Outputs

| Name | Description |
|------|-------------|
|  [agentless\_scanning\_sa\_emails](#output\_agentless\_scanning\_sa\_emails) | Agentless scanning Service Account emails per infra project (if DSPM enabled) |
|  [agentless\_scanning\_wif\_principal](#output\_agentless\_scanning\_wif\_principal) | The agentless scanning WIF IAM principal (if DSPM enabled) |
|  [log\_sink\_names](#output\_log\_sink\_names) | Names of the created log sinks (if RTV&D enabled) |
|  [log\_subscription\_id](#output\_log\_subscription\_id) | The ID of the Pub/Sub subscription for log ingestion (if RTV&D enabled) |
|  [log\_topic\_id](#output\_log\_topic\_id) | The ID of the Pub/Sub topic for log ingestion (if RTV&D enabled) |
|  [registration\_id](#output\_registration\_id) | The unique CrowdStrike registration ID for this GCP setup |
|  [wif\_iam\_principal](#output\_wif\_iam\_principal) | The IAM principal that CrowdStrike uses to access GCP resources |
|  [wif\_pool\_id](#output\_wif\_pool\_id) | The ID of the created Workload Identity Pool |
|  [wif\_pool\_provider\_id](#output\_wif\_pool\_provider\_id) | The ID of the created Workload Identity Pool Provider |
|  [wif\_project\_id](#output\_wif\_project\_id) | The GCP Project ID where Workload Identity resources were created |
|  [wif\_project\_number](#output\_wif\_project\_number) | The GCP Project Number for the Workload Identity project |