iac-eval-v2/iac-eval-v2 huggingface dataset:
# Task 199


Enable contributor insights on a table named "ExampleTableName"

## Intent

Create a DynamoDB table and enable contributor insights

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_dynamodb_contributor_insights" "test" {
  table_name = "ExampleTableName"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS DynamoDB Contributor Insights is being created for a specific table
aws_dynamodb_contributor_insights_valid(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_contributor_insights"
}

# Aggregate all checks
allow if {
    aws_dynamodb_contributor_insights_valid(input.resource_changes)
}

main if {
    allow
}
# Task 200


Create a cluster with dax.r4.large and replication factor = 1.

## Intent

require a cluster name, iam_role_arn, node_type, replication factor

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_iam_role" "example" {
  name = "redshift_role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = "sts:AssumeRole",
        Effect = "Allow",
        Principal = {
          Service = "redshift.amazonaws.com"
        },
      },
    ],
  })
}

resource "aws_dax_cluster" "bar" {
  cluster_name       = "cluster-example"
  iam_role_arn       = aws_iam_role.example.arn
  node_type          = "dax.r4.large"
  replication_factor = 1
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dax_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_dax_cluster"
    resource.change.after.node_type == "dax.r4.large"
    resource.change.after.replication_factor == 1
}

# Aggregate all checks
allow if {
    aws_dax_cluster_valid(input.resource_changes)
}

main if {
    allow
}
# Task 209


Create a serverless MSK cluster in us-east1.

## Intent

Has one "aws_msk_serverless_cluster" resource
Requires aws provider with alias of "aws" with a region of us-east-1

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "vpc" {
    cidr_block = "192.168.0.0/22"
    enable_dns_support = true
    enable_dns_hostnames = true
}

data "aws_availability_zones" "azs" {
    state = "available"
}

resource "aws_subnet" "subnet_az1" {
    availability_zone = data.aws_availability_zones.azs.names[0]
    cidr_block = "192.168.0.0/24"
    vpc_id = aws_vpc.vpc.id
    map_public_ip_on_launch = true
}

resource "aws_subnet" "subnet_az2" {
    availability_zone = data.aws_availability_zones.azs.names[1]
    cidr_block = "192.168.1.0/24"
    vpc_id = aws_vpc.vpc.id
    map_public_ip_on_launch = true
}

resource "aws_subnet" "subnet_az3" {
    availability_zone = data.aws_availability_zones.azs.names[2]
    cidr_block = "192.168.2.0/24"
    vpc_id = aws_vpc.vpc.id
    map_public_ip_on_launch = true
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.vpc.id
}

resource "aws_route_table" "main" {
  vpc_id = aws_vpc.vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
}

resource "aws_route_table_association" "first" {
  subnet_id      = aws_subnet.subnet_az1.id
  route_table_id = aws_route_table.main.id
}

resource "aws_route_table_association" "second" {
  subnet_id      = aws_subnet.subnet_az2.id
  route_table_id = aws_route_table.main.id
}

resource "aws_route_table_association" "third" {
  subnet_id      = aws_subnet.subnet_az3.id
  route_table_id = aws_route_table.main.id
}

resource "aws_security_group" "sg" {
    vpc_id = aws_vpc.vpc.id
}

resource "aws_vpc_security_group_ingress_rule" "ingress1" {
  security_group_id = aws_security_group.sg.id
  cidr_ipv4 = "0.0.0.0/0"
  ip_protocol = "-1"
}

resource "aws_vpc_security_group_egress_rule" "egress1" {
  security_group_id = aws_security_group.sg.id
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "-1"
}

resource "aws_msk_serverless_cluster" "example" {
    cluster_name = "Example"

    vpc_config {
        subnet_ids = [aws_subnet.subnet_az1.id, aws_subnet.subnet_az2.id, aws_subnet.subnet_az3.id]
        security_group_ids = [aws_security_group.sg.id]
    }

    client_authentication {
        sasl {
            iam {
                enabled = true
            }
        }
    }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

msk_serverless_cluster_created(resources) if {
    some resource in resources
    resource.type == "aws_msk_serverless_cluster"
    resource.change.actions[_] == "create"
}

allow if {
    msk_serverless_cluster_created(input.resource_changes)
}

main if {
    allow
}
# Task 212


Create a serverless MSK cluster in us-east2.

## Intent

Has one "aws_msk_serverless_cluster" resource
Requires aws provider with alias of "aws" with a region of us-east-2

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-2"
}

resource "aws_vpc" "vpc" {
    cidr_block = "192.168.0.0/22"
    enable_dns_support = true
    enable_dns_hostnames = true
}

data "aws_availability_zones" "azs" {
    state = "available"
}

resource "aws_subnet" "subnet_az1" {
    availability_zone = data.aws_availability_zones.azs.names[0]
    cidr_block = "192.168.0.0/24"
    vpc_id = aws_vpc.vpc.id
    map_public_ip_on_launch = true
}

resource "aws_subnet" "subnet_az2" {
    availability_zone = data.aws_availability_zones.azs.names[1]
    cidr_block = "192.168.1.0/24"
    vpc_id = aws_vpc.vpc.id
    map_public_ip_on_launch = true
}

resource "aws_subnet" "subnet_az3" {
    availability_zone = data.aws_availability_zones.azs.names[2]
    cidr_block = "192.168.2.0/24"
    vpc_id = aws_vpc.vpc.id
    map_public_ip_on_launch = true
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.vpc.id
}

resource "aws_route_table" "main" {
  vpc_id = aws_vpc.vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
}

resource "aws_route_table_association" "first" {
  subnet_id      = aws_subnet.subnet_az1.id
  route_table_id = aws_route_table.main.id
}

resource "aws_route_table_association" "second" {
  subnet_id      = aws_subnet.subnet_az2.id
  route_table_id = aws_route_table.main.id
}

resource "aws_route_table_association" "third" {
  subnet_id      = aws_subnet.subnet_az3.id
  route_table_id = aws_route_table.main.id
}

resource "aws_security_group" "sg" {
    vpc_id = aws_vpc.vpc.id
}

resource "aws_vpc_security_group_ingress_rule" "ingress1" {
  security_group_id = aws_security_group.sg.id
  cidr_ipv4 = "0.0.0.0/0"
  ip_protocol = "-1"
}

resource "aws_vpc_security_group_egress_rule" "egress1" {
  security_group_id = aws_security_group.sg.id
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "-1"
}

resource "aws_msk_serverless_cluster" "example" {
    cluster_name = "Example"

    vpc_config {
        subnet_ids = [aws_subnet.subnet_az1.id, aws_subnet.subnet_az2.id, aws_subnet.subnet_az3.id]
        security_group_ids = [aws_security_group.sg.id]
    }

    client_authentication {
        sasl {
            iam {
                enabled = true
            }
        }
    }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

msk_serverless_cluster_created(resources) if {
    some resource in resources
    resource.type == "aws_msk_serverless_cluster"
    resource.change.actions[_] == "create"
}

allow if {
    msk_serverless_cluster_created(input.resource_changes)
}

main if {
    allow
}
# Task 216


Create an Aurora MySQL cluster.

## Intent

Has a aws_rds_cluster with engine=="aurora-mysql"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}

resource "aws_rds_cluster" "default" {
cluster_identifier = "aurora-cluster-demo"
engine = "aurora-mysql"
availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
database_name = "mydb"
master_username = "USERNAME"
master_password = "PASSWORD"
backup_retention_period = 5
preferred_backup_window = "07:00-09:00"
skip_final_snapshot = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for Aurora MySQL RDS cluster creation
rds_cluster_created(resources) if {
some resource in resources
resource.type == "aws_rds_cluster"
resource.change.actions[_] == "create"
}

# Check if the RDS cluster engine is Aurora MySQL
rds_cluster_engine_valid(resource) if {
resource.type == "aws_rds_cluster"
resource.change.after.engine == "aurora-mysql"
}

# Aggregate checks for Aurora MySQL RDS
allow if {
# RDS Cluster Checks
rds_cluster_created(input.resource_changes)
some resource in input.resource_changes
rds_cluster_engine_valid(resource)
}

main if {
    allow
}
# Task 217


Create an Aurora PostgresQL cluster

## Intent

Has a aws_rds_cluster with engine=="aurora-postgresql"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}

resource "aws_rds_cluster" "default" {
cluster_identifier = "aurora-cluster-demo"
engine = "aurora-postgresql"
availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
database_name = "mydb"
master_username = "USERNAME"
master_password = "PASSWORD"
backup_retention_period = 5
preferred_backup_window = "07:00-09:00"
skip_final_snapshot = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for Aurora MySQL RDS cluster creation
rds_cluster_created(resources) if {
some resource in resources
resource.type == "aws_rds_cluster"
resource.change.actions[_] == "create"
}

# Check if the RDS cluster engine is Aurora MySQL
rds_cluster_engine_valid(resource) if {
resource.type == "aws_rds_cluster"
resource.change.after.engine == "aurora-postgresql"
}

# Aggregate checks for Aurora MySQL RDS
allow if {
# RDS Cluster Checks
rds_cluster_created(input.resource_changes)
some resource in input.resource_changes
rds_cluster_engine_valid(resource)
}

main if {
    allow
}
# Task 218


Create an mySQL cluster with 100 GB allocated to each zone.

## Intent

Has one "aws_rds_cluster" resource
with one "allocated_storage" = 100

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}

resource "aws_rds_cluster" "example" {
cluster_identifier = "example"
availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
engine = "mysql"
db_cluster_instance_class = "db.r6gd.large"
storage_type = "io1"
allocated_storage = 100
iops = 1000
master_username = "test"
master_password = "mustbeeightcharaters"
skip_final_snapshot = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for RDS cluster creation
rds_cluster_created(resources) if {
some resource in resources
resource.type == "aws_rds_cluster"
resource.change.actions[_] == "create"
}

# Check if storage per AZ is at least 1000 GB
storage_per_az_valid(resource) if {
resource.type == "aws_rds_cluster"
resource.change.after.allocated_storage == 100
}

# Aggregate checks for RDS cluster
allow if {
rds_cluster_created(input.resource_changes)
some resource in input.resource_changes
storage_per_az_valid(resource)
}

main if {
    allow
}
# Task 219


Create an mySQL cluster with 100 GB allocated to us-east-1a, us-east-1b, us-east-1c.

## Intent

Has one "aws_rds_cluster" resource
with one "allocated_storage" = 100
with one "availability_zones" = ["us-east-1a", "us-east-1b", "us-east-1c"]
with one "engine" = "mysql"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}

resource "aws_rds_cluster" "example" {
cluster_identifier = "example"
availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
engine = "mysql"
db_cluster_instance_class = "db.r6gd.large"
storage_type = "io1"
allocated_storage = 100
iops = 1000
master_username = "test"
master_password = "mustbeeightcharaters"
skip_final_snapshot = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Required AZs
required_azs := ["us-east-1a", "us-east-1b", "us-east-1c"]

# Check for RDS cluster creation
rds_cluster_created(resources) if {
some resource in resources
resource.type == "aws_rds_cluster"
resource.change.actions[_] == "create"
}

# Check if engine is MySQL
rds_engine_mysql(resource) if {
resource.type == "aws_rds_cluster"
resource.change.after.engine == "mysql"
}

# Check if AZs are correct and storage is 100GB
azs_and_storage_valid(resource) if {
resource.type == "aws_rds_cluster"
resource.change.after.availability_zones == required_azs
resource.change.after.allocated_storage == 100
}

# Aggregate checks for RDS cluster
allow if {
rds_cluster_created(input.resource_changes)
some resource in input.resource_changes
rds_engine_mysql(resource)
azs_and_storage_valid(resource)
}

main if {
    allow
}
# Task 220


Create a mySQL instance.

## Intent

Has one "aws_db_instance" resource
with one "engine" = "mysql"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}

resource "aws_db_instance" "default" {
allocated_storage = 10
db_name = "mydb"
engine = "mysql"
instance_class = "db.t3.micro"
username = "USERNAME"
password = "PASSWORD"
parameter_group_name = "default.mysql5.7"
skip_final_snapshot = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for DB instance creation
db_instance_created(resources) if {
some resource in resources
resource.type == "aws_db_instance"
resource.change.actions[_] == "create"
}

# Check if engine is MySQL
db_engine_mysql(resource) if {
resource.type == "aws_db_instance"
resource.change.after.engine == "mysql"
}

# Aggregate checks for DB instance
allow if {
db_instance_created(input.resource_changes)
some resource in input.resource_changes
db_engine_mysql(resource)
}

main if {
    allow
}
# Task 221


Create a PostgresQL instance.

## Intent

Has one "aws_db_instance" resource
with one "engine" = "postgres"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_db_instance" "default" {
allocated_storage = 10
db_name = "mydb"
engine = "postgres"
instance_class = "db.t3.micro"
username = "USERNAME"
password = "PASSWORD"
skip_final_snapshot = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for DB instance creation
db_instance_created(resources) if {
some resource in resources
resource.type == "aws_db_instance"
resource.change.actions[_] == "create"
}

# Check if engine is MySQL
db_engine_mysql(resource) if {
resource.type == "aws_db_instance"
resource.change.after.engine == "postgres"
}

# Aggregate checks for DB instance
allow if {
db_instance_created(input.resource_changes)
some resource in input.resource_changes
db_engine_mysql(resource)
}

main if {
    allow
}
# Task 222


Create a DynamoDB table.

## Intent

Has one "aws_dynamodb_table" resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_dynamodb_table" "example" {
name = "example"
hash_key = "TEST_KEY"
billing_mode = "PAY_PER_REQUEST"
stream_enabled = true
stream_view_type = "NEW_AND_OLD_IMAGES"

attribute {
name = "TEST_KEY"
type = "S"
}

replica {
region_name = "us-east-2"
}

replica {
region_name = "us-west-2"
}
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for DynamoDB table creation
dynamodb_table_created(resources) if {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

# Aggregate checks for DynamoDB table
allow if {
dynamodb_table_created(input.resource_changes)
}

main if {
    allow
}
# Task 223


Create a DynamoDB table with replicas in us-east-2 and us-west-2

## Intent

Has one "aws_dynamodb_table" resource
with one "replica"
with one "region_name" = "us-east-2"
with one "replica"
with one "region_name" = "us-west-2"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_dynamodb_table" "example" {
name = "example"
hash_key = "TestTableHashKey"
billing_mode = "PAY_PER_REQUEST"
stream_enabled = true
stream_view_type = "NEW_AND_OLD_IMAGES"

attribute {
name = "TestTableHashKey"
type = "S"
}

replica {
region_name = "us-east-2"
}

replica {
region_name = "us-west-2"
}
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Required replica regions
required_regions := {"us-east-2", "us-west-2"}

# Check for DynamoDB table creation
dynamodb_table_created(resources) if {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

# Check if replicas match required regions exactly
replicas_valid(resource) if {
resource.type == "aws_dynamodb_table"
resource.change.after.replica[0].region_name == "us-east-2"
resource.change.after.replica[1].region_name == "us-west-2"
}

# Aggregate checks for DynamoDB table creation with specific replicas
allow if {
dynamodb_table_created(input.resource_changes)
some resource in input.resource_changes
replicas_valid(resource)
}

main if {
    allow
}
# Task 224


Create a DynamoDB with point-in-time recovery enabled.

## Intent

Has one "aws_dynamodb_table" resource
with one "point_in_time_recovery"
with one "enabled" = true

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_dynamodb_table" "example" {
name = "your-dynamodb-table-name"
billing_mode = "PAY_PER_REQUEST" # Or "PROVISIONED" if you prefer provisioned capacity
hash_key = "id"
attribute {
name = "id"
type = "S"
}

point_in_time_recovery {
enabled = true # Set to true to enable point-in-time recovery
}

}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for DynamoDB table creation
dynamodb_table_created(resources) if {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

# Check if point-in-time recovery is enabled
point_in_time_recovery_enabled(resource) if {
resource.type == "aws_dynamodb_table"
resource.change.after.point_in_time_recovery[_].enabled == true
}

# Aggregate checks for DynamoDB table with PITR
allow if {
dynamodb_table_created(input.resource_changes)
some resource in input.resource_changes
point_in_time_recovery_enabled(resource)
}

main if {
    allow
}
# Task 225


Create a DynamoDB Table with replicas in us-west-1 and us-west-2.

## Intent

Has one "aws_dynamodb_global_table" resource
with one "replica"
with one "region_name" = "us-east-1"
with one "replica"
with one "region_name" = "us-west-2"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region  = "us-east-1"
}

resource "aws_dynamodb_table" "base_table" {
  billing_mode     = "PAY_PER_REQUEST"
  hash_key         = "myAttribute"
  name             = "myTable"
  stream_enabled   = true
  stream_view_type = "NEW_AND_OLD_IMAGES"

  attribute {
    name = "myAttribute"
    type = "S"
  }

  replica {
    region_name = "us-west-1"
  }

  replica {
    region_name = "us-west-2"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

dynamodb_table_created(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_table"
    resource.change.actions[_] == "create"
    resource.change.after.name == "myTable"
}

replicas_valid(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_table"
    resource.change.after.replica[_].region_name == "us-west-1"
    resource.change.after.replica[_].region_name == "us-west-2"
}

allow if {
    dynamodb_table_created(input.resource_changes)
    replicas_valid(input.resource_changes)
}

main if {
    allow
}
# Task 226


Create a DynamoDB table with read and write capacity both set to 10.

## Intent

Has one "aws_dynamodb_table" resource
with one "read_capacity" = 10
with one "write_capacity" = 10

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_dynamodb_table" "basic-dynamodb-table" {
name = "GameScores"
billing_mode = "PROVISIONED"
read_capacity = 10
write_capacity = 10
hash_key = "UserId"
range_key = "GameTitle"

attribute {
name = "UserId"
type = "S"
}

attribute {
name = "GameTitle"
type = "S"
}

tags = {
Name = "dynamodb-table-1"
Environment = "production"
}
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for DynamoDB table creation
dynamodb_table_created(resources) if {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

# Check if read and write capacity are both set to 10
capacity_valid(resource) if {
resource.type == "aws_dynamodb_table"
resource.change.after.read_capacity == 10
resource.change.after.write_capacity == 10
}

# Aggregate checks for DynamoDB table creation with specific capacity
allow if {
dynamodb_table_created(input.resource_changes)
some resource in input.resource_changes
capacity_valid(resource)
}

main if {
    allow
}