cloud_group

This data source provides information about a single CrowdStrike Cloud Group. Look the group up by ID, or with an FQL filter that matches exactly one group, and reference its attributes in other resources.

API Scopes

The following API scopes are required:

• Cloud Groups V2: READ

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

# Look up a cloud group by its UUID.
data "crowdstrike_cloud_group" "by_id" {
  id = "d3adb33f-dead-beef-dead-beefdeadbeef"
}

# Look up a cloud group with an FQL filter. Group names are unique within a CID,
# so an equality filter on name resolves at most one group.
data "crowdstrike_cloud_group" "by_name" {
  filter = "name:'Production Accounts'"
}

output "prod_accounts_owners" {
  value = data.crowdstrike_cloud_group.by_name.owners
}

Filtering

Provide id to look a cloud group up by its UUID, or filter to find it with a Falcon Query Language (FQL) expression. A filter must resolve to exactly one group: the data source fails if it matches none, and fails if it matches more than one.

For the FQL syntax itself, the operators, and how to escape a value in a Terraform string, see the Filtering with Falcon Query Language guide. This page covers what is specific to cloud groups.

Filterable properties

Property	Matches
name	The group name.
description	The group description.
business_impact	The group’s impact tag: low, moderate, or high.
business_unit	The group’s business unit tag.
environment	The group’s environment tag: dev, test, stage, or prod.
created_at	When the group was created.
updated_at	When the group was last updated.
id	The group’s UUID. Prefer the id argument, which uses the dedicated by-ID endpoint.
cloud_provider	A cloud provider in the group’s selectors: aws, azure, or gcp.
account_id	An account ID in the group’s selectors.
region	A region in the group’s selectors, for example us-west-2.
cloud_provider_tag	A cloud resource tag in the group’s selectors, in key=value form.
image_registry	An image registry in the group’s selectors.
image_repository	An image repository in the group’s selectors.
image_tag	An image tag in the group’s selectors.
gcrn	A cloud resource name.

Schema

Optional

• filter (String) An FQL filter that resolves to exactly one cloud group: the lookup fails if it matches none or more than one. Exactly one of id or filter must be provided. See the Filtering with Falcon Query Language guide for the syntax, and the Filtering section of this page for the properties cloud groups can be filtered on and the caveats that apply to them.
• id (String) The UUID of the cloud group. Set this to look the group up directly by identifier. Exactly one of id or filter must be provided.

Read-Only

• aws (Attributes) AWS cloud resource configuration (see below for nested schema)
• azure (Attributes) Azure cloud resource configuration (see below for nested schema)
• business_impact (String) An impact level that reflects how critical the cloud group’s assets are to business operations. Valid values: high, moderate, low.
• business_unit (String) A free-text label used to associate the cloud group with an internal team.
• created_at (String) The timestamp when the group was created.
• created_by (String) The API client ID that created the group.
• description (String) The description of the cloud group.
• environment (String) Environment designation for the group. Valid values: dev, test, stage, prod.
• gcp (Attributes) GCP cloud resource configuration (see below for nested schema)
• images (Attributes List) The container images accessible to the group. Each entry includes a registry and filters for repositories and tags. (see below for nested schema)
• name (String) The name of the cloud group.
• owners (List of String) Contact information for stakeholders responsible for the cloud group. List of email addresses.

Nested Schema for aws

Read-Only:

• account_ids (List of String) The cloud account identifiers (AWS account IDs) included in the group. When empty, resources across all accounts in the cloud provider are accessible to the group.
• filters (Attributes) Filters for AWS cloud resources (see below for nested schema)

Nested Schema for aws.filters

Read-Only:

• region (List of String) List of AWS regions included
• tags (List of String) List of tags filtered by (format: key=value)

Nested Schema for azure

Read-Only:

• account_ids (List of String) The cloud account identifiers (Azure subscription IDs) included in the group. When empty, resources across all accounts in the cloud provider are accessible to the group.
• filters (Attributes) Filters for Azure cloud resources (see below for nested schema)

Nested Schema for azure.filters

Read-Only:

• region (List of String) List of Azure regions included
• tags (List of String) List of tags filtered by (format: key=value)

Nested Schema for gcp

Read-Only:

• account_ids (List of String) The cloud account identifiers (GCP project IDs) included in the group. When empty, resources across all accounts in the cloud provider are accessible to the group.
• filters (Attributes) Filters for GCP cloud resources. Note: GCP does not support tag filtering. (see below for nested schema)

Nested Schema for gcp.filters

Read-Only:

• region (List of String) List of GCP regions included

Nested Schema for images

Read-Only:

• registry (String) The container registry included in the group.
• repositories (List of String) The container image repositories within the specified registry filtered by.
• tags (List of String) The container image tags filtered by.