user

This resource allows management of a user on the CrowdStrike Falcon platform.

A user account identifies a person who accesses the Falcon console and determines which resources they can access. Every user account has a home CID, which is where the account is created, stored, and managed. A user is identified by their email address, which must be unique: it cannot be used by another user or added in another CID.

Assign roles to a user with the crowdstrike_user_role_assignment resource.

Password management

To set an initial password, provide it with the write-only password_wo argument together with password_wo_version. If you omit both, the user is created without a password: when SSO is not enabled, CrowdStrike sends the user an automated email prompting them to create a Falcon password and configure MFA. When SSO is enabled, no email is sent.

The Falcon API has no in-place password-change endpoint, so changing a password is realized as a resource replacement. Changing password_wo alone has no effect, since write-only values are never stored in state and cannot produce a plan diff. To apply a new password, increment password_wo_version: this destroys and recreates the user with the current password_wo value. The new user has a different id (user_uuid), which affects any resources that reference it. To change a password without replacing the user, use the Reset password action in the Falcon console instead.

API Scopes

The following API scopes are required:

• User management: READ
• User management: WRITE

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

variable "user_password" {
  description = "Initial password for the Falcon user."
  type        = string
  sensitive   = true
}

# Create a user with an initial password.
#
# password_wo is write-only and is never stored in state. Because the Falcon
# API has no in-place password-change endpoint, changing the password requires
# replacing the user: increment password_wo_version to apply a new password
# (this deletes and recreates the user with a new UUID).
resource "crowdstrike_user" "with_password" {
  email               = "jane.doe@example.com"
  first_name          = "Jane"
  last_name           = "Doe"
  password_wo         = var.user_password
  password_wo_version = 1
}

# Create a user without a password. When SSO is not enabled, CrowdStrike sends
# the user an automated email prompting them to create a password and configure
# MFA.
resource "crowdstrike_user" "invite" {
  email      = "john.smith@example.com"
  first_name = "John"
  last_name  = "Smith"
}

Schema

Required

• email (String) The user’s email address, which is also their login. Must be unique: it cannot be used by another user or in another CID. The domain must belong to the CID’s domain allowlist, which is configured during the CID’s initial provisioning (contact Support to change it). In CIDs with single sign-on (SSO) enabled, the email address must exactly match the information in your IdP. Changing this forces a new user to be created.
• first_name (String) The user’s first name.
• last_name (String) The user’s last name.

Optional

• cid (String) The customer ID (CID) to create the user in, which becomes the user’s home CID. Falcon Flight Control (FCTL) customers making requests from the parent CID can set this to the ID of a child CID. If not provided, the user is created in the CID making the request (the CID associated with the provider credentials). Changing this forces a new user to be created.
• password_wo (String, Sensitive) The user’s initial password. This is a write-only argument: it is never stored in Terraform state. Because the Falcon API has no in-place password-change endpoint, changing the password requires replacing the user; use password_wo_version to trigger that replacement. If omitted, the user is created without a password. When SSO is not enabled, CrowdStrike sends the user an automated email prompting them to create a password and configure MFA. Must be set together with password_wo_version.
• password_wo_version (Number) The version of password_wo. Increment this value to apply a new password. Because there is no in-place password-change API, changing this forces the user to be replaced (deleted and recreated), which mints a new UUID and drops any role assignments attached to the old UUID. Must be set together with password_wo.

Read-Only

• created_at (String) When the user was created (RFC-3339 format).
• factors (Set of String) The multi-factor authentication (MFA) factors configured for the user.
• id (String) The UUID assigned to the user by CrowdStrike.
• last_login_at (String) When the user last logged in (RFC-3339 format).
• status (String) The user’s current status.
• updated_at (String) When the user was last updated (RFC-3339 format).
• user_type (String) The user’s type.

Import

Import is supported using the following syntax:

# User can be imported by specifying the id.
terraform import crowdstrike_user.example 7fb858a949034a0cbca175f660f1e769