cloud_google_registration_settings

This resource manages settings for a Google Cloud registration in Falcon Cloud Security that may not be known until after the registration has been created, such as log ingestion and Workload Identity Federation (WIF) configuration.

API Scopes

The following API scopes are required:

• Cloud Security Google Cloud Registration: READ
• Cloud Security Google Cloud Registration: WRITE

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

resource "crowdstrike_cloud_google_registration" "registration" {
  name               = "my-google-cloud-project-registration"
  projects           = ["my-google-cloud-project-id"]
  infra_project      = "my-infra-project-id"
  wif_project        = "my-wif-project-id"
  wif_project_number = "123456789012"

  realtime_visibility = {
    enabled = true
  }
}

resource "crowdstrike_cloud_google_registration_settings" "example" {
  registration_id                 = crowdstrike_cloud_google_registration.registration.id
  log_ingestion_sink_name         = "crowdstrike-log-sink"
  log_ingestion_topic_id          = "crowdstrike-log-topic"
  log_ingestion_subscription_name = "crowdstrike-log-subscription"
  wif_pool_name                   = "crowdstrike-wif-pool"
  wif_provider_name               = "crowdstrike-wif-provider"

  depends_on = [crowdstrike_cloud_google_registration.registration]
}

output "log_ingestion_settings" {
  value = crowdstrike_cloud_google_registration_settings.example
}

Schema

Required

• registration_id (String) The Google Cloud registration ID to configure settings for.

Optional

• agentless_scanning_settings (Attributes) Agentless scanning settings. Only configurable after the agentless scanning infrastructure has been created via Terraform. (see below for nested schema)
• log_ingestion_sink_name (String) The name of the log sink for ingestion.
• log_ingestion_subscription_name (String) The Pub/Sub subscription name for log ingestion.
• log_ingestion_topic_id (String) The Pub/Sub topic ID for log ingestion.
• wif_pool_name (String) The Workload Identity Federation (WIF) pool name.
• wif_provider_name (String) The Workload Identity Federation (WIF) provider name.

Nested Schema for agentless_scanning_settings

Required:

• deployment_version (String) The TF module deployment version for tracking.
• infra (Attributes Map) Per-project scanning infrastructure details, keyed by GCP project ID. In cross-project mode this contains a single entry for the host project. (see below for nested schema)
• network_configuration_type (String) Network configuration type for scanner VMs: managed (with NAT), managed_no_nat, or custom (BYO VPC).
• regions (Set of String) The GCP regions where agentless scanning infrastructure is deployed.
• wif_principal (String) The Workload Identity Federation principal for the agentless scanning.

Optional:

• custom_network (Attributes) Custom (BYO) network configuration. Required when network_configuration_type is ‘custom’. (see below for nested schema)
• host_project_id (String) The GCP project hosting shared scanning infrastructure. When set, indicates cross-project mode.
• org_id (String) The GCP organization ID. Required only for folder-scoped registrations.

Nested Schema for agentless_scanning_settings.infra

Required:

• client_credentials_secret_name (String) The Secret Manager secret name containing Falcon client credentials for scanner authentication.
• network (Attributes) Network configuration for scanner VMs in this project. (see below for nested schema)
• scanner_sa_email (String) The service account email used by the scanner in this project.

Nested Schema for agentless_scanning_settings.infra.network

Required:

• subnets (Map of String) Map of region to subnet name for scanner VMs.
• vpc_name (String) The VPC network name used by scanner VMs.

Nested Schema for agentless_scanning_settings.custom_network

Required:

• subnets (Map of String) Map of region to subnet name within the custom VPC.
• vpc_name (String) The name of the customer-provided VPC network.

Import

Import is supported using the following syntax:

# The log ingestion settings for a previously registered Google Cloud project can be imported by registration ID.
terraform import crowdstrike_cloud_google_registration_settings.example <registration-id>