AWS Falcon Cloud Security Terraform Module

This Terraform module enables registration and configuration of AWS accounts with CrowdStrike's Falcon Cloud Security.

Key features: - Asset Inventory - Real-time Visibility and Detection - Identity Protection (IDP) - Sensor Management - Data Security Posture Management (DSPM)

[!NOTE] For multi-region deployments, this module needs to be instantiated separately for each region where FCS components are required.

Pre-requisites

Generate API Keys

CrowdStrike API keys are required to use this module. It is highly recommended that you create a dedicated API client with only the required scopes.

1. In the CrowdStrike console, navigate to Support and resources > API Clients & Keys. Click Add new API Client.
2. Add the required scopes for your deployment:

Option	Scope Name	Permission
Automated account registration	CSPM registration	Read and Write
	Cloud security AWS registration	Read and Write
1-click sensor management	CSPM sensor management	Read and Write
	Installation tokens	Read
	Sensor download	Read
DSPM	DSPM Data scanner	Read and Write

1. Click Add to create the API client. The next screen will display the API CLIENT ID, SECRET, and BASE URL. You will need all three for the next step.

   picture

   

[!NOTE] This page is only shown once. Make sure you copy CLIENT ID, SECRET, and BASE URL to a secure location.

Usage

```hcl terraform { requiredversion = ">= 0.15" requiredproviders { aws = { source = "hashicorp/aws" version = ">= 4.45" } crowdstrike = { source = "CrowdStrike/crowdstrike" version = ">= 0.0.19" } } }

variable "falconclientid" { type = string sensitive = true description = "Falcon API Client ID" }

variable "falconclientsecret" { type = string sensitive = true description = "Falcon API Client Secret" }

variable "accountid" { type = string default = "" description = "The AWS 12 digit account ID" validation { condition = length(var.accountid) == 0 || can(regex("^[0-9]{12}$", var.accountid)) errormessage = "account_id must be either empty or the 12-digit AWS account ID" } }

locals { enablerealtimevisibility = true primaryregion = "us-east-1" enableidp = true enablesensormanagement = true enabledspm = true dspmregions = ["us-east-1", "us-east-2"] useexistingcloudtrail = true }

provider "crowdstrike" { clientid = var.falconclientid clientsecret = var.falconclientsecret } provider "aws" { region = "us-east-1" alias = "us-east-1" } provider "aws" { region = "us-east-2" alias = "us-east-2" }

Provision AWS account in Falcon.

resource "crowdstrikecloudawsaccount" "this" { accountid = local.account_id

asset_inventory = { enabled = true }

realtimevisibility = { enabled = local.enablerealtimevisibility cloudtrailregion = local.primaryregion useexistingcloudtrail = local.useexisting_cloudtrail }

idp = { enabled = local.enable_idp }

sensormanagement = { enabled = local.enablesensor_management }

dspm = { enabled = local.enable_dspm } }

module "fcsaccountonboarding" { source = "CrowdStrike/cloud-registration/aws" falconclientid = var.falconclientid falconclientsecret = var.falconclientsecret accountid = var.accountid primaryregion = local.primaryregion enablesensormanagement = local.enablesensormanagement enablerealtimevisibility = local.enablerealtimevisibility enableidp = local.enableidp useexistingcloudtrail = local.useexistingcloudtrail enabledspm = local.enabledspm && contains(local.dspmregions, "us-east-1") dspmregions = local.dspm_regions

iamrolename = crowdstrikecloudawsaccount.this.iamrolename externalid = crowdstrikecloudawsaccount.this.externalid intermediaterolearn = crowdstrikecloudawsaccount.this.intermediaterolearn eventbusarn = crowdstrikecloudawsaccount.this.eventbusarn cloudtrailbucketname = crowdstrikecloudawsaccount.this.cloudtrailbucket_name

providers = { aws = aws.us-east-1 crowdstrike = crowdstrike } }

for each region where you want to onboard Real-time Visibility or DSPM features

- duplicate this module

- update the provider with region specific one

module "fcsaccountuseast2" { source = "CrowdStrike/cloud-registration/aws" falconclientid = var.falconclientid falconclientsecret = var.falconclientsecret accountid = var.accountid primaryregion = local.primaryregion enablesensormanagement = local.enablesensormanagement enablerealtimevisibility = local.enablerealtimevisibility enableidp = local.enableidp useexistingcloudtrail = local.useexistingcloudtrail enabledspm = local.enabledspm && contains(local.dspmregions, "us-east-2") dspmregions = local.dspm_regions

iamrolename = crowdstrikecloudawsaccount.this.iamrolename externalid = crowdstrikecloudawsaccount.this.externalid intermediaterolearn = crowdstrikecloudawsaccount.this.intermediaterolearn eventbusarn = crowdstrikecloudawsaccount.this.eventbusarn cloudtrailbucketname = crowdstrikecloudawsaccount.this.cloudtrailbucket_name

providers = { aws = aws.us-east-2 crowdstrike = crowdstrike } } ```

Providers

| Name | Version | |------|---------| | aws | >= 4.45 | | crowdstrike | >= 0.0.19 |

Resources

| Name | Type | |------|------| | aws_region.current | data source | | crowdstrikecloudaws_account.target | data source |

Inputs

| Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | account_id | The AWS 12 digit account ID | string | "" | no | | account_type | Account type can be either 'commercial' or 'gov' | string | "commercial" | no | | cloudtrail_bucket_name | Name of the S3 bucket for CloudTrail logs | string | "" | no | | create_rtvd_rules | Set to false if you don't want to enable monitoring in this region | bool | true | no | | dspm_integration_role_unique_id | The unique ID of the DSPM integration role | string | "" | no | | dspm_regions | The regions in which DSPM scanning environments will be created | list(string) |

[
  "us-east-1"
]

| no | | dspm_create_nat_gateway | Set to true to create a NAT Gateway for DSPM scanning environments | bool | true | no | | dspm_s3_access | Apply permissions for S3 bucket scanning | bool | true | no | | dspm_dynamodb_access | Apply permissions for DynamoDB table scanning | bool | true | no | | dspm_rds_access | Apply permissions for RDS instance scanning | bool | true | no | | dspm_redshift_access | Apply permissions for Redshift cluster scanning | bool | true | no | | dspm_role_name | The unique name of the IAM role that DSPM will be assuming | string | "CrowdStrikeDSPMIntegrationRole" | no | | dspm_scanner_role_name | The unique name of the IAM role that CrowdStrike Scanner will be assuming | string | "CrowdStrikeDSPMScannerRole" | no | | dspm_scanner_role_unique_id | The unique ID of the DSPM scanner role | string | "" | no | | enable_dspm | Set to true to enable Data Security Posture Managment | bool | false | no | | enable_idp | Set to true to install Identity Protection resources | bool | false | no | | enable_realtime_visibility | Set to true to install realtime visibility resources | bool | false | no | | enable_sensor_management | Set to true to install 1Click Sensor Management resources | bool | n/a | yes | | eventbridge_role_name | The eventbridge role name | string | "CrowdStrikeCSPMEventBridge" | no | | eventbus_arn | Eventbus ARN to send events to | string | "" | no | | external_id | The external ID used to assume the AWS reader role | string | "" | no | | falcon_client_id | Falcon API Client ID | string | n/a | yes | | falcon_client_secret | Falcon API Client Secret | string | n/a | yes | | iam_role_name | The name of the reader role | string | "" | no | | intermediate_role_arn | The intermediate role that is allowed to assume the reader role | string | "" | no | | is_gov | Set to true if you are deploying in gov Falcon | bool | false | no | | organization_id | The AWS Organization ID. Leave blank if when onboarding single account | string | "" | no | | permissions_boundary | The name of the policy used to set the permissions boundary for IAM roles | string | "" | no | | primary_region | Region for deploying global AWS resources (IAM roles, policies, etc.) that are account-wide and only need to be created once. Distinct from dspm_regions which controls region-specific resource deployment. | string | n/a | yes | | resource_prefix | The prefix to be added to all resource names | string | "CrowdStrike" | no | | resource_suffix | The suffix to be added to all resource names | string | "" | no | | tags | A map of tags to add to all resources that support tagging | map(string) | {} | no | | use_existing_cloudtrail | Set to true if you already have a cloudtrail | bool | false | no | | use_existing_iam_reader_role | Set to true if you want to use an existing IAM role for asset inventory | bool | false | no |

Outputs

| Name | Description | |------|-------------| | integration_role_unique_id | The unique ID of the DSPM integration role | | scanner_role_unique_id | The unique ID of the DSPM scanner role | <!-- ENDTFDOCS -->