ngsiem_data_connector_config

Manages a reusable NG-SIEM data connector configuration. A config holds the per-connector connection parameters and credentials, is scoped to a single connector, and is referenced by one or more data connections via config_id. Editing a config affects every connection that references it.

API Scopes

The following API scopes are required:

• NGSIEM Data Connections API: READ
• NGSIEM Data Connections API: WRITE

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {}

resource "crowdstrike_ngsiem_data_connector_config" "s3_access_logs" {
  # AWS S3 Access Log Data Connector from the connector catalog.
  connector_id = "07d3b89a204f41d988e198bd2d6536d8"
  name         = "prod-s3-access-logs"

  # Per-connector parameters, encoded as JSON. The exact shape is validated
  # server-side per connector. For AWS S3 the fields are account_id, sqs_name,
  # region, bucket, and prefix, plus an authentication_method that gates further
  # required fields.
  params = jsonencode({
    account_id            = "123456789012"
    bucket                = "my-access-log-bucket"
    prefix                = "logs/"
    region                = "us-east-1"
    sqs_name              = "my-s3-notification-queue"
    authentication_method = "iam_assume_role"
    iam_assume_role       = "arn:aws:iam::123456789012:role/crowdstrike-s3-ingest"
  })
}

Schema

Required

• connector_id (String) The connector catalog ID this config belongs to. Changing this forces a new resource to be created.
• name (String) The name of the connector config.
• params (String) Per-connector connection parameters, encoded as a JSON string. The shape is connector-specific and validated server-side.

Optional

• auth (String, Sensitive) Per-connector auth blob, encoded as a JSON string. Required for connectors that split credentials out (Okta, Slack, Salesforce, Box, Atlassian, etc.); may be omitted for connectors (like AWS S3) that carry credentials inside params. Not returned by the API on read.

Read-Only

• id (String) The ID of the connector config.

Import

Import is supported using the following syntax:

# NG-SIEM connector configs are imported using both the connector catalog id and
# the config id, separated by a comma: "<connector_id>,<config_id>".
terraform import crowdstrike_ngsiem_data_connector_config.example 07d3b89a204f41d988e198bd2d6536d8,2837b61e8d9d4d6c8b125a3b90958d60