iac-eval-v2/iac-eval-v2 huggingface dataset:
# Task 376


Create a Lightsail instance with resource access to a Lightsail bucket in the `eu-west-1` region (use availability zone `eu-west-1a`).

## Intent

have one aws_lightsail_bucket
    with name
    with bundle_id

have one aws_lightsail_bucket_resource_access
    with bucket_name
    with resource_name

have one "aws_lightsail_instance" resource
    with "name" argument
    with "availability_zone" argument
    with "blueprint_id" argument
    with "bundle_id" argument

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region     = "eu-west-1"
}

resource "aws_lightsail_bucket" "test" {
  name      = "mytestbucket"
  bundle_id = "small_1_0"
}

resource "aws_lightsail_instance" "test" {
  name              = "mytestinstance"
  availability_zone = "eu-west-1a"
  blueprint_id      = "amazon_linux_2"
  bundle_id         = "nano_1_0"
}

resource "aws_lightsail_bucket_resource_access" "test" {
  bucket_name   = aws_lightsail_bucket.test.name
  resource_name = aws_lightsail_instance.test.name
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_valid_resources = false

# Rule for aws_lightsail_bucket resource
has_valid_lightsail_bucket if {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lightsail_bucket"
    resource.values.name
    resource.values.bundle_id
}

# Rule for aws_lightsail_bucket_resource_access resource
has_valid_lightsail_bucket_access if {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lightsail_bucket_resource_access"
    resource.values.bucket_name
    resource.values.resource_name
}

# Rule for aws_lightsail_instance resource with specific arguments
has_valid_lightsail_instance if {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lightsail_instance"
    resource.values.name
    resource.values.availability_zone
    resource.values.blueprint_id
    resource.values.bundle_id
}

# Combined rule to ensure all conditions are met
has_valid_resources if {
    has_valid_lightsail_bucket
    has_valid_lightsail_bucket_access
    has_valid_lightsail_instance
}

main if {
    has_valid_lightsail_bucket
    has_valid_lightsail_bucket_access
    has_valid_lightsail_instance
    has_valid_resources
}
# Task 377


Provides a lightsail certificate.

## Intent

have one aws_lightsail_certificate
    with name
    with domain_name

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_lightsail_certificate" "test" {
  name                      = "test"
  domain_name               = "testdomain.com"
  subject_alternative_names = ["www.testdomain.com"]
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_valid_lightsail_certificate = false

# Rule for aws_lightsail_certificate resource with specific arguments
has_valid_lightsail_certificate if {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lightsail_certificate"
    resource.values.name
    resource.values.domain_name
}

main if {
    has_valid_lightsail_certificate
}
# Task 378


managing an AWS Lightsail Distribution with bucket as the origin

## Intent

have one aws_lightsail_distribution
    with name
    with bundle_id
    with default_cache_behavior 
        with behavior
    with origin 
        with name
        with region_name
    with cache_behavior_settings 
        with forwarded_cookies
            with cookies_allow_list 
        with forwarded_headers  
            with headers_allow_list 
        with forwarded_query_strings 
            with query_strings_allowed_list

have one aws_lightsail_bucket
    with name
    with bundle_id

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_lightsail_bucket" "test" {
  name      = "test-bucket"
  bundle_id = "small_1_0"
}
resource "aws_lightsail_distribution" "test" {
  name      = "test-distribution"
  bundle_id = "small_1_0"
  origin {
    name        = aws_lightsail_bucket.test.name
    region_name = aws_lightsail_bucket.test.region
  }
  default_cache_behavior {
    behavior = "cache"
  }
  cache_behavior_settings {
    allowed_http_methods = "GET,HEAD,OPTIONS,PUT,PATCH,POST,DELETE"
    cached_http_methods  = "GET,HEAD"
    default_ttl          = 86400
    maximum_ttl          = 31536000
    minimum_ttl          = 0
    forwarded_cookies {
      option = "none"
    }
    forwarded_headers {
      option = "default"
    }
    forwarded_query_strings {
      option = false
    }
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_valid_resources = false

# Rule for aws_lightsail_distribution resource
has_valid_lightsail_distribution if {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lightsail_distribution"
    resource.values.name
    resource.values.bundle_id
}

# Rule for aws_lightsail_bucket resource
has_valid_lightsail_bucket if {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lightsail_bucket"
    resource.values.name
    resource.values.bundle_id
}

# Combined rule to ensure both conditions are met
has_valid_resources if {
    has_valid_lightsail_distribution
    has_valid_lightsail_bucket
}

main if {
    has_valid_lightsail_distribution
    has_valid_lightsail_bucket
    has_valid_resources
}
# Task 379


managing an AWS Lightsail Distribution with a instance as an origin

## Intent

have one aws_lightsail_instance
    with "name" argument
    with "availability_zone" argument
    with "blueprint_id" argument
    with "bundle_id" argument

have one aws_lightsail_distribution
    with name
    with bundle_id
    with default_cache_behavior 
        with behavior
    with origin 
        with name
        with region_name
    with cache_behavior_settings 
        with forwarded_cookies
            with cookies_allow_list 
        with forwarded_headers  
            with headers_allow_list 
        with forwarded_query_strings 
            with query_strings_allowed_list

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

data "aws_availability_zones" "available" {
  state = "available"

  filter {
    name   = "opt-in-status"
    values = ["opt-in-not-required"]
  }
}

resource "aws_lightsail_static_ip_attachment" "test" {
  static_ip_name = aws_lightsail_static_ip.test.name
  instance_name  = aws_lightsail_instance.test.name
}

resource "aws_lightsail_static_ip" "test" {
  name = "test-static-ip"
}

resource "aws_lightsail_instance" "test" {
  name              = "test-instance"
  availability_zone = data.aws_availability_zones.available.names[0]
  blueprint_id      = "amazon_linux_2"
  bundle_id         = "micro_1_0"
}

resource "aws_lightsail_distribution" "test" {
  name       = "test-distribution"
  depends_on = [aws_lightsail_static_ip_attachment.test]
  bundle_id  = "small_1_0"
  origin {
    name        = aws_lightsail_instance.test.name
    region_name = data.aws_availability_zones.available.id
  }
  default_cache_behavior {
    behavior = "cache"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_valid_lightsail_resources = false

# Rule for aws_lightsail_instance resource
has_lightsail_instance if {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lightsail_instance"
}

# Rule for aws_lightsail_distribution resource
has_lightsail_distribution if {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lightsail_distribution"
}

# Combined rule to ensure both resources are present
has_valid_lightsail_resources if {
    has_lightsail_instance
    has_lightsail_distribution
}

main if {
    has_valid_lightsail_resources
}
# Task 380


an S3 Glacier vault for long-term data archiving

## Intent

has one "aws_glacier_vault" resource
     with "name" attribute

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"  # Replace with your desired AWS region
}

resource "aws_glacier_vault" "example" {
  name = "my-glacier-vault"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_glacier_vault = false

# Rule to validate if there is at least one aws_glacier_vault resource with a name attribute
is_valid_glacier_vault if {
    # Find a resource that is of type aws_glacier_vault
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_glacier_vault"

    # Check that the resource has a name attribute
    has_value(resource.values.name)
}

# Helper function to check if a value exists (not null)
has_value(value) if {
    not is_null(value)
}

main if {
    is_valid_glacier_vault
}
# Task 381


generate a aws storage for long term data and backup

## Intent

has one "aws_glacier_vault" resource
     with "name" attribute

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"  # Replace with your desired AWS region
}

resource "aws_glacier_vault" "example" {
  name = "my-glacier-vault"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_glacier_vault = false

# Rule to validate if there is at least one aws_glacier_vault resource with a name attribute
is_valid_glacier_vault if {
    # Find a resource that is of type aws_glacier_vault
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_glacier_vault"

    # Check that the resource has a name attribute
    has_value(resource.values.name)
}

# Helper function to check if a value exists (not null)
has_value(value) if {
    not is_null(value)
}

main if {
    is_valid_glacier_vault
}
# Task 385


generage an S3 Glacier vault with a access policy

## Intent

has one "aws_glacier_vault" resource
     with "name" attribute
     with "access_policy" attribute

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region     = "us-east-1"
}

data "aws_iam_policy_document" "my_archive" {
  statement {
    sid    = "add-read-only-perm"
    effect = "Allow"

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    actions = [
      "glacier:InitiateJob",
      "glacier:GetJobOutput",
    ]

    resources = ["arn:aws:glacier:eu-west-1:432981146916:vaults/MyArchive"]
  }
}

resource "aws_glacier_vault" "my_archive" {
  name = "MyArchive"
  access_policy = data.aws_iam_policy_document.my_archive.json

  tags = {
    Test = "MyArchive"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_terraform_plan = false

# Rule to check for an AWS Glacier Vault resource with 'name' and 'access_policy' attributes
is_valid_glacier_vault if {
	resource := input.planned_values.root_module.resources[_]
	resource.type == "aws_glacier_vault"
	not is_null(resource.values.name)
	not is_null(resource.values.access_policy)
}

# Combined rule to validate the entire Terraform plan
is_valid_terraform_plan if {
	is_valid_glacier_vault
}

main if {
    is_valid_glacier_vault
    is_valid_terraform_plan
}
# Task 386


generage an S3 Glacier vault with a Vault Lock

## Intent

has one "aws_glacier_vault" resource
     with "name" attribute

implicit:
has one "aws_iam_policy_document" data
has one "aws_glacier_vault_lock" resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region     = "us-east-1"
}

resource "aws_glacier_vault" "example" {
  name = "example"
}

data "aws_iam_policy_document" "example" {
  statement {
    actions   = ["glacier:DeleteArchive"]
    effect    = "Deny"
    resources = [aws_glacier_vault.example.arn]

    condition {
      test     = "NumericLessThanEquals"
      variable = "glacier:ArchiveAgeinDays"
      values   = ["365"]
    }
  }
}

resource "aws_glacier_vault_lock" "example" {
  complete_lock = false
  policy        = data.aws_iam_policy_document.example.json
  vault_name    = aws_glacier_vault.example.name
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_terraform_plan = false

# Rule to check for an AWS Glacier Vault resource with 'name' and 'access_policy' attributes
is_valid_glacier_vault if {
	resource := input.planned_values.root_module.resources[_]
	resource.type == "aws_glacier_vault"
	not is_null(resource.values.name)
}

# Rule to check for the existence of an AWS Glacier Vault Lock resource
is_valid_glacier_vault_lock if {
	resource := input.planned_values.root_module.resources[_]
	resource.type == "aws_glacier_vault_lock"
}

# Combined rule to validate the entire Terraform plan
is_valid_terraform_plan if {
	is_valid_glacier_vault
	is_valid_glacier_vault_lock
}

main if {
    is_valid_glacier_vault
    is_valid_glacier_vault_lock
    is_valid_terraform_plan
}
# Task 387


generage an S3 Glacier vault with a access policy using "aws_iam_policy_document" data and lock the policy using "aws_glacier_vault_lock"

## Intent

has one "aws_glacier_vault" resource
     with "name" attribute
     with "access_policy" attributr

implicit:
has one "aws_iam_policy_document" data
has one "aws_glacier_vault_lock" resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region     = "us-east-1"
}

resource "aws_glacier_vault" "example" {
  name = "example"
}

data "aws_iam_policy_document" "example" {
  statement {
    actions   = ["glacier:DeleteArchive"]
    effect    = "Deny"
    resources = [aws_glacier_vault.example.arn]

    condition {
      test     = "NumericLessThanEquals"
      variable = "glacier:ArchiveAgeinDays"
      values   = ["365"]
    }
  }
}

resource "aws_glacier_vault_lock" "example" {
  complete_lock = false
  policy        = data.aws_iam_policy_document.example.json
  vault_name    = aws_glacier_vault.example.name
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_terraform_plan = false

# Rule to check for an AWS Glacier Vault resource with 'name' and 'access_policy' attributes
is_valid_glacier_vault if {
	resource := input.planned_values.root_module.resources[_]
	resource.type == "aws_glacier_vault"
	not is_null(resource.values.name)
}

# Rule to check for the existence of an AWS Glacier Vault Lock resource
is_valid_glacier_vault_lock if {
	resource := input.planned_values.root_module.resources[_]
	resource.type == "aws_glacier_vault_lock"
}

# Combined rule to validate the entire Terraform plan
is_valid_terraform_plan if {
	is_valid_glacier_vault
	is_valid_glacier_vault_lock
}

main if {
    is_valid_glacier_vault
    is_valid_glacier_vault_lock
    is_valid_terraform_plan
}
# Task 388


generage an S3 Glacier vault that pushes notification when archive retrieval completed

## Intent

has one "aws_glacier_vault" resource
     with "name" attribute
     with notification attribute
        with sns_topic attribute
        with events attribute

has one aws_sns_topic resources
    with name attribute

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region     = "us-east-1"
}

# Create an SNS topic for notifications
resource "aws_sns_topic" "glacier_notifications" {
  name = "glacier-archive-retrieval-notifications"
}

# Create an S3 Glacier Vault
resource "aws_glacier_vault" "my_archive" {
  name = "MyArchive"

  notification {
    sns_topic = aws_sns_topic.glacier_notifications.arn
    events    = ["ArchiveRetrievalCompleted"]
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_terraform_plan = false

# Rule to check for an AWS Glacier Vault resource with 'name' and 'notification' attributes
is_valid_glacier_vault if {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_glacier_vault"
    not is_null(resource.values.name)
    not is_null(resource.values.notification)
}

# Rule to check for the existence of an AWS SNS Topic resource with 'name' attribute
is_valid_sns_topic if {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_sns_topic"
    not is_null(resource.values.name)
}

# Combined rule to validate the entire Terraform plan
is_valid_terraform_plan if {
    is_valid_glacier_vault
    is_valid_sns_topic
}

main if {
    is_valid_glacier_vault
    is_valid_sns_topic
    is_valid_terraform_plan
}
# Task 407


create a basic AWS RDS instance

## Intent

Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_db_instance" "default" {
  allocated_storage    = 10
  db_name              = "mydb"
  engine               = "mysql"
  engine_version       = "5.7"
  instance_class       = "db.t3.micro"
  username             = "foo"
  password             = "foobarbaz"
  parameter_group_name = "default.mysql5.7"
  skip_final_snapshot  = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
}

requirement1(after) if {
    after.allocated_storage != null
    after.engine != null
    after.username != null
    is_valid_engine(after.engine)
}

requirement1(after) if {
    after.snapshot_identifier != null
}

requirement1(after) if {
    after.replicate_source_db != null
}

requirement2(after) if {
    after.instance_class != null
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.password != null
}

requirement3(after) if {
    after.manage_master_user_password == true
}

requirement3(after) if {
    after.snapshot_identifier != null
}

requirement3(after) if {
    after.replicate_source_db != null
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
}
# Task 408


create a basic AWS SQL database

## Intent

Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_db_instance" "default" {
  allocated_storage    = 10
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  password             = "foobarbaz"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
}

requirement1(after) if {
    after.allocated_storage != null
    after.engine == "mysql"
    after.username != null
    is_valid_engine(after.engine)
}

requirement2(after) if {
    after.instance_class != null
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.password != null
}

requirement3(after) if {
    after.manage_master_user_password == true
}

requirement3(after) if {
    after.snapshot_identifier != null
}

requirement3(after) if {
    after.replicate_source_db != null
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
}