rtr_put_file

Manages an RTR put file, which can be deployed to hosts via the RTR put command. The underlying API supports create, read, and delete operations only, so changing any configurable attribute forces replacement.

API Scopes

The following API scopes are required:

• Real Time Response (Admin): READ
• Real Time Response (Admin): WRITE

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

resource "crowdstrike_rtr_put_file" "remediation_script" {
  name           = "remediation.ps1"
  source         = "${path.module}/files/remediation.ps1"
  description    = "PowerShell remediation script for incident response"
  content_sha256 = filesha256("${path.module}/files/remediation.ps1")

  comments_for_audit_log = "Managed by Terraform"
}

output "rtr_put_file_id" {
  value = crowdstrike_rtr_put_file.remediation_script.id
}

Schema

Required

• name (String) Name of the RTR put file.
• source (String) Path to a local file to upload.

Optional

• comments_for_audit_log (String) Audit log comment for the put file creation.
• content_sha256 (String) SHA256 hash of the source file for change detection. Use filesha256() to trigger replacement when file content changes.
• description (String) Description of the RTR put file.

Read-Only

• created_by (String) User who created the file.
• created_timestamp (String) Timestamp when the file was created.
• file_type (String) Detected file type.
• id (String) Identifier for the RTR put file.
• modified_by (String) User who last modified the file.
• modified_timestamp (String) Timestamp when the file was last modified.
• permission_type (String) Permission type of the file.
• platform (List of String) Platforms the file is available on.
• sha256 (String) SHA256 hash of the uploaded file.
• size (Number) Size of the uploaded file in bytes.

Import

Import is supported using the following syntax:

# Rtr Put File can be imported by specifying the id.
terraform import crowdstrike_rtr_put_file.example 7fb858a949034a0cbca175f660f1e769