user_role_assignment

This resource manages the complete set of Falcon roles assigned directly to an existing user within a customer ID (CID). User roles determine what a user can see and do in the Falcon console.

The set of role_ids is authoritative for permanently, directly-assigned roles: roles present on the user but absent from the configuration are revoked, and roles in the configuration but absent from the user are granted. Roles assigned directly outside of Terraform in this CID will be removed on the next apply.

Omitting role_ids leaves the user with no directly-assigned roles.

The roles in role_ids are granted to the user in the CID set by cid. Use the crowdstrike_cid data source to get the CID for the authenticating credentials.

Roles a user inherits through a user group or CID group (Falcon Flight Control), and temporary roles (granted with an expiration), are not shown or managed by this resource and are left untouched.

API Scopes

The following API scopes are required:

• User management: READ
• User management: WRITE

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

variable "user_uuid" {
  description = "UUID of the existing Falcon user to assign roles to."
  type        = string
}

data "crowdstrike_cid" "current" {}

resource "crowdstrike_user_role_assignment" "example" {
  user_uuid = var.user_uuid
  cid       = data.crowdstrike_cid.current.cid

  role_ids = [
    "event_viewer",
    "help_desk",
  ]
}

Schema

Required

• cid (String) The customer ID (CID) to grant the roles in. Falcon Flight Control (FCTL) customers making requests from the parent CID can set this to the ID of a child CID. Provide the 32-character lowercase hexadecimal CID without the checksum suffix (e.g. abcdef1234567890abcdef1234567890, not ABCDEF1234567890ABCDEF1234567890-0F); use the crowdstrike_cid data source to get the CID for the authenticating credentials. Changing this forces a new resource to be created.
• user_uuid (String) The UUID of the existing user to assign roles to. Changing this forces a new resource to be created.

Optional

• role_ids (Set of String) The set of role IDs to assign directly to the user. This set is authoritative for permanently, directly-granted roles. Omit it to revoke every directly-assigned role. Use the crowdstrike_user_roles data source to list the role IDs available in a CID.

Import

Import is supported using the following syntax:

# User role assignments are imported using `user_uuid,cid`, where cid is the CID
# the roles are granted in:
terraform import crowdstrike_user_role_assignment.example <user_uuid>,<cid>