firewall_policy_precedence

This resource allows you to set the precedence of Firewall Policies based on the order of IDs.

In a Flight Control (MSSP) environment the precedence API only manages the policies that belong to the CID authenticated by the provider. Policies belonging to other CIDs (parent or child) are returned by the API but cannot be reordered, so they are excluded automatically. Resolving the authenticated CID requires the Sensor Download: Read scope; without it, precedence can only be managed for tenants that are not part of a Flight Control hierarchy.

API Scopes

The following API scopes are required:

• Firewall management: READ
• Firewall management: WRITE
• Sensor Download: READ

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

# Manage precedence of Windows firewall policies (dynamic mode)
# Policies listed here will be prioritized in order, other policies retain their relative ordering
resource "crowdstrike_firewall_policy_precedence" "example" {
  platform_name = "Windows"
  enforcement   = "dynamic"
  ids = [
    "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6",
    "b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7",
    "c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8",
  ]
}

output "firewall_policy_precedence" {
  value = crowdstrike_firewall_policy_precedence.example
}

Schema

Required

• enforcement (String) The enforcement type for this resource. strict requires all non-default firewall policy IDs for the platform to be provided. dynamic will ensure the provided policies have precedence over others. When using dynamic, policy IDs not included in ids will retain their current ordering after the managed IDs.
• ids (List of String) The policy IDs in order. The first ID specified will have the highest precedence and the last ID specified will have the lowest.
• platform_name (String) The platform of the firewall policies. (Windows, Mac, Linux)

Import

Import is supported using the following syntax:

# Firewall policy precedence cannot be imported as it is a virtual resource
# that manages the ordering of existing policies. Simply define the resource
# in your configuration with the desired policy order.