cloud_security_iac_custom_rule

This resource manages custom cloud security IAC rules. These rules enable scanning of Infrastructure as Code (IaC) configurations for security issues and policy violations using custom Rego policies.

API Scopes

The following API scopes are required:

• Cloud Security Policies: READ
• Cloud Security Policies: WRITE
• Infrastructure-as-Code: READ
• Infrastructure-as-Code: WRITE

Example Usage

resource "crowdstrike_cloud_security_iac_custom_rule" "example" {
  name           = "Check SSH Access from Anywhere"
  description    = "Detects security groups that allow SSH access from any IP address"
  cloud_provider = "AWS"
  resource_type  = "EC2"
  severity       = "high"

  logic = <<-EOF
    package crowdstrike

    import rego.v1

    default result := "fail"

    # Only governs security groups; pass every other resource type through.
    result := "pass" if {
      not input.resource.aws_security_group
    }

    # Passes only when no ingress rule opens SSH (port 22) to 0.0.0.0/0.
    result := "pass" if {
      every _, sg in input.resource.aws_security_group {
        not allows_ssh_from_anywhere(sg)
      }
    }

    allows_ssh_from_anywhere(sg) if {
      some rule in sg.ingress
      rule.from_port == 22
      "0.0.0.0/0" in rule.cidr_blocks
    }
  EOF

  remediation_info = [
    "Review the security group configuration",
    "Restrict SSH access to specific IP ranges",
    "Consider using AWS Systems Manager Session Manager instead"
  ]

  alert_info = [
    "Check if the security group allows SSH from 0.0.0.0/0",
    "Verify the resource configuration meets security requirements"
  ]

  category = "Network Security"

  labels = ["aws", "network", "ssh", "critical"]
}

# Example using file() function to load logic from an external file
resource "crowdstrike_cloud_security_iac_custom_rule" "with_file" {
  name           = "Check S3 Bucket Public Access"
  description    = "Ensures S3 buckets have public access blocks enabled"
  cloud_provider = "AWS"
  resource_type  = "S3"
  severity       = "high"

  # Load Rego policy from external file
  logic = file("${path.module}/s3_public_access.rego")

  remediation_info = [
    "Enable block_public_acls on the S3 bucket",
    "Review S3 bucket public access settings"
  ]

  alert_info = [
    "S3 bucket is missing public access block configuration"
  ]

  category = "Data Security"

  labels = ["aws", "s3", "data-protection"]
}

Schema

Required

• cloud_provider (String) Cloud provider for the policy rule. Valid values are AWS, Azure, GCP, General.
• description (String) Description of the policy rule.
• logic (String) Rego logic for the rule.
• name (String) Name of the policy rule.

Optional

• alert_info (List of String) A list of the alert logic and detection criteria for rule violations.
• category (String) Grouping category for the rule (e.g., Encryption, Networking, Backup). The API may normalize the casing.
• labels (List of String) Array of string labels for filtering and organizing rules. Changing this requires replacing the resource. The API may normalize the casing.
• remediation_info (List of String) Information about how to remediate issues detected by this rule. Do not include numbering within this list. The Falcon console will automatically add numbering.
• resource_type (String) Service-level category. Examples: ACM, S3, IAM for AWS; AKS, Key Vault for Azure; BigQuery, GKE for GCP. Defaults to Custom.
• severity (String) Severity of the rule. Valid values are critical, high, medium, informational. Defaults to critical.

Read-Only

• iac_framework (String) Infrastructure-as-code framework for the custom rule. Currently only Terraform is supported.
• id (String) Unique identifier of the policy rule.

Import

Import is supported using the following syntax:

# The IaC custom rule can be imported using its unique identifier.
terraform import crowdstrike_cloud_security_iac_custom_rule.example 7c86a274-c04b-4292-9f03-dafae42bde97