The argument does not belong to the set.

[sluzby]

Firstly thank you for the great documentation and putting this together. It's greatly helpful.

I deployed my instance in this case via CI/CD pipline rather than importing the template directly. And the parameters for Customer ID and Secret were resolved correclty.

However when I launch the instance I can see that crowdstrike didn't install and if I look closer I face the error below:

The strings for the customer ID and Secret passthrough correctly
C:\Windows\Temp\sensor.ps1 : Cannot validate argument on parameter 'BaseAddress'. The argument
"245dfccXXXXXXXXXXXXXXXX" does not belong to the set "https://api.crowdstrike.com,https://api.us-2.crowdstrike
.com,https://api.eu-1.crowdstrike.com,https://api.laggar.gcw.crowdstrike.com" specified by the ValidateSet attribute.
Supply an argument that is in the set and then try the command again.

Also which permissions / scope do I need to set for the API creds need from the crowstrike console for this to work.

Thanks!

[sluzby]

After reviewing the script I can see so that answers the second part of me question.

The script must be run as an administrator on the local machine in order for the Falcon Sensor installation to complete, and the OAuth2 API Client being used requires 'sensor-update-policies:read' and 'sensor-installers:read' permissions.

[jshcodes]

You beat me to it. 😄

[sluzby]

I think these days in the console it's now called sensor-downloads as I don't see sensor-installers.

[jshcodes]

You are 💯 correct, this would be Sensor Download scope.

[jshcodes]

This looks like the variable being passed for BaseAddress is a CID value. Since it's not in the list of available base URLs, an error is thrown.

For the download you would need READ permissions within the Sensor Download scope. For the sensor policies, you would need READ in Sensor Update Policy.

[jshcodes]

Are you using the version of the script located here?

[sluzby]

I think so yes:

UserData: Fn::Base64: !Sub | <powershell> $client = new-object System.Net.WebClient $client.DownloadFile("https://raw.githubusercontent.com/CrowdStrike/Cloud-AWS/master/Agent-Install-Examples/powershell/sensor_install.ps1","C:\Windows\Temp\sensor.ps1") C:\Windows\Temp\sensor.ps1 ${FalconClientID} ${FalconClientSecret} Remove-Item C:\Windows\Temp\sensor.ps1 Remove-Item C:\Windows\Temp\UserScript.ps1 </powershell>

[jshcodes]

Yeah, I think adding the missing parameter is the answer here. Would you let us know if this resolves it for you? We'll get the template / documentation updated based upon your result.

[sluzby]

It did resolve it for me!

Created an SSM Parameter string with the Base URL Value e.g. https://api.crowdstrike.com/

as I'm deploying in via CI/CD I then added the parameter with default

FalconBaseAddress: Type: AWS::SSM::Parameter::Value<String> Description: Name of the SSM Parameter containing the Falcon API Base Address Default: /example/crowdstrike/baseaddress
Then added the to the parameters in the template in the correct order

C:\Windows\Temp\sensor.ps1 ${FalconBaseAddress} ${FalconClientID} ${FalconClientSecret}

Thanks,

Jos

[jshcodes]

Perfect! We'll get this template and the documentation updated. Thank you for reporting this!! 😄