terraform-azurerm-cloud-registration

Introduction

This Terraform module enables registration and configuration of Azure accounts with CrowdStrike's Falcon Cloud Security. It provides a comprehensive solution for integrating Azure environments with CrowdStrike's cloud security services, including service principal creation, asset inventory configuration, and real-time visibility through log ingestion.

Key features:

• Service Principal creation with Microsoft Graph permissions
• Asset Inventory configuration for both subscription and management group scopes
• Real-time visibility with log ingestion (Activity Logs and Entra ID logs)
• Automatic discovery of active subscriptions within management groups

Pre-requisites

Generate API Keys

CrowdStrike API keys are required to use this module. It is highly recommended that you create a dedicated API client with only the required scopes.

1. In the CrowdStrike console, navigate to Support and resources > API Clients & Keys. Click Add new API Client.

2. Add the required scopes for your deployment:

    Option
    Scope Name
    Permission
   
    Automated account registration
    CSPM registration
    Read and Write
   
    Cloud security Azure registration
    Read and Write

3. Click Add to create the API client. The next screen will display the API CLIENT ID, SECRET, and BASE URL. You will need all three for the next step.

   picture

[!NOTE]
This page is only shown once. Make sure you copy CLIENT ID, SECRET, and BASE URL to a secure location.

Usage

terraform {
  required_version = ">= 1.9.0"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 4.13.0"
    }
    azuread = {
      source  = "hashicorp/azuread"
      version = ">= 3.0.0"
    }

    crowdstrike = {
      source  = "CrowdStrike/crowdstrike"
      version = ">= 0.0.55"
    }
  }
}

provider "azurerm" {
  subscription_id = "00000000-0000-0000-0000-000000000000" # Replace with your subscription ID that will host CrowdStrike's infrastructure resources
  features {}
}

provider "azuread" {
}

provider "crowdstrike" {
  client_id     = ""
  client_secret = ""
}

module "crowdstrike_azure_registration" {
  source = "CrowdStrike/cloud-registration/azurerm"

  # Azure configuration - You can use subscriptions, management groups, or both
  subscription_ids     = ["subscription-id-1", "subscription-id-2"]
  management_group_ids = ["mg-id-1", "mg-id-2"]

  # Azure subscription that will host CrowdStrike infrastructure. Required when `enable_realtime_visibility` is set to `true`.
  cs_infra_subscription_id = "00000000-0000-0000-0000-000000000000"

  # Optional: CrowdStrike API credential
  falcon_client_id     = ""
  falcon_client_secret = ""

  # Optional: CrowdStrike IP addresses for network security. Required when `enable_realtime_visibility` is set to `true`.
  falcon_ip_addresses = ["1.2.3.4", "5.6.7.8"]

  # Optional: Enable Real Time Visibility and Detection
  enable_realtime_visibility = true

  # Optional: Configure log ingestion settings
  log_ingestion_settings = {
    activity_log = {
      enabled = true
      # To use existing Event Hub resource ID and consumer group name, specify this section with existing_eventhub.use = true and provide existing Event Hub resource ID and consumer group name
      # existing_eventhub = {
      #     use = true
      #     eventhub_resource_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-existing-eventhub/providers/Microsoft.EventHub/namespaces/existing-eventhub-namespace/eventhubs/existing-eventhub"
      #     eventhub_consumer_group_name = "$Default"
      # }
    }
    entra_id_log = {
      enabled = true
      # To use existing Event Hub resource ID and consumer group name, specify this section with existing_eventhub.use = true and provide existing Event Hub resource ID and consumer group name
      # existing_eventhub = {
      #     use = true
      #     eventhub_resource_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-existing-eventhub/providers/Microsoft.EventHub/namespaces/existing-eventhub-namespace/eventhubs/existing-eventhub"
      #     eventhub_consumer_group_name = "$Default"
      # }
    }
  }

  # Optional: Customize Microsoft Graph app roles
  # microsoft_graph_permission_ids = [
  #   "9a5d68dd-52b0-4cc2-bd40-abcf44ac3a30", # Application.Read.All
  #   "98830695-27a2-44f7-8c18-0c3ebc9698f6", # GroupMember.Read.All
  #   "246dd0d5-5bd0-4def-940b-0421030a5b68", # Policy.Read.All
  #   "230c1aed-a721-4c5d-9cb4-a90514e508ef", # Reports.Read.All
  #   "483bed4a-2ad3-4361-a73b-c83ccdbdc53c", # RoleManagement.Read.All
  #   "df021288-bdef-4463-88db-98f22de89214"  # User.Read.All
  # ]

  # Optional: Resource naming customization
  # env can be empty or exactly 4 alphanumeric characters
  env             = "prod" # or "" for no environment suffix
  location        = "westus"
  resource_prefix = "cs-"
  resource_suffix = "-001"

  # Optional: Custom tags
  tags = {
    Environment = "Production"
    Project     = "CrowdStrike Integration"
    CSTagVendor = "CrowdStrike"
  }
}

Providers

Resources

Inputs

activity_log = optional(object({
  enabled = bool
  existing_eventhub = optional(object({
    use                          = bool
    eventhub_resource_id         = optional(string, "")
    eventhub_consumer_group_name = optional(string, "")
  }), { use = false })
}), { enabled = true })
entra_id_log = optional(object({
  enabled = bool
  existing_eventhub = optional(object({
    use                          = bool
    eventhub_resource_id         = optional(string, "")
    eventhub_consumer_group_name = optional(string, "")
  }), { use = false })
}), { enabled = true })

}) | {} | no |
| management_group_ids | List of Azure management group IDs to monitor with CrowdStrike Falcon Cloud Security. All subscriptions within these management groups will be automatically discovered and monitored. | list(string) | [] | no |
| microsoft_graph_permission_ids | Optional list of Microsoft Graph permission IDs to assign to the service principal. If provided, these will replace the default permissions. | list(string) | null | no |
| resource_prefix | Prefix to be added to all created resource names for identification. | string | "" | no |
| resource_suffix | Suffix to be added to all created resource names for identification. | string | "" | no |
| subscription_ids | List of specific Azure subscription IDs to monitor with CrowdStrike Falcon Cloud Security. Use this for targeted monitoring of individual subscriptions. | list(string) | [] | no |
| tags | Map of tags to be applied to all resources created by this module. Default includes the CrowdStrike vendor tag. | map(string) | {
"CSTagVendor": "CrowdStrike"
} | no |

Outputs