iac-eval-v2/iac-eval-v2 huggingface dataset:
# Task 442


creates an egress-only internet gateway associated with a specified VPC, allowing IPv6-enabled instances to connect to the internet without allowing inbound internet traffic

## Intent

Has one "aws_egress_only_internet_gateway" resource:
Associated with a specified "aws_vpc" resource
Designed to allow IPv6-enabled instances within the VPC to connect to the internet while preventing inbound internet traffic

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_egress_only_internet_gateway" "pike" {
  vpc_id = "vpc-0c33dc8cd64f408c4"
  tags = {
    pike = "permissions"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_egress_only_internet_gateway = false

is_valid_egress_only_internet_gateway if {
        some i
        resource := input.resource_changes[i]
        resource.type == "aws_egress_only_internet_gateway"
        has_vpc_id(resource)
}

has_vpc_id(resource) if {
        resource.change.after.vpc_id != null
}

has_vpc_id(resource) if {
        resource.change.after_unknown.vpc_id == true
}

main if {
    is_valid_egress_only_internet_gateway
}