response_policy_precedence

This resource allows you set the precedence of Response Policies based on the order of IDs.

In a Flight Control (MSSP) environment the precedence API only manages the policies that belong to the CID authenticated by the provider. Policies belonging to other CIDs (parent or child) are returned by the API but cannot be reordered, so they are excluded automatically. Resolving the authenticated CID requires the Sensor Download: Read scope; without it, precedence can only be managed for tenants that are not part of a Flight Control hierarchy.

API Scopes

The following API scopes are required:

• Response Policies: READ
• Response Policies: WRITE
• Sensor Download: READ

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}


resource "crowdstrike_response_policy_precedence" "example" {
  ids = [
    "a1j09y3yq0wnrpb5o6jlij9e4f40k6lq",
    "2asia54xti93bg0jbr5hfpqqbhxbyeoa",
    "xuzq8hs1uyc2s7zdar3fli0shiyl22vc",
  ]
  platform_name = "linux"
  enforcement   = "dynamic"
}

output "response_policy_precedence" {
  value = crowdstrike_response_policy_precedence.example
}

Schema

Required

• enforcement (String) The enforcement type for this resource. strict requires all non-default response policy ids for platform to be provided. dynamic will ensure the provided policies have precedence over others. When using dynamic, policy ids not included in ids will retain their current ordering after the managed ids.
• ids (List of String) The policy ids in order. The first ID specified will have the highest precedence and the last ID specified will have the lowest.
• platform_name (String) The platform of the response policies. One of: Windows, Mac, Linux

Read-Only

• last_updated (String) Timestamp of the last Terraform update of the resource.