iac-eval-v2/iac-eval-v2 huggingface dataset:
# Task 148


Create a 2-node RedShift cluster and attach a resource policy to it.

## Intent

Create a redshift cluster and a aws_reedshift_resource_poliicy attached to it

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "redshift-cluster-1"
  node_type          = "dc2.large"
  cluster_type       = "multi-node"
  number_of_nodes    = 2

  database_name = "mydb"
  master_username = "foo"
  master_password = "Mustbe8characters"

  skip_final_snapshot = true
}

resource "aws_redshift_resource_policy" "example" {
  resource_arn = aws_redshift_cluster.example.cluster_namespace_arn
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        AWS = "arn:aws:iam::12345678901:root"
      }
      Action   = "redshift:CreateInboundIntegration"
      Resource = aws_redshift_cluster.example.cluster_namespace_arn
      Sid      = ""
    }]
  })
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_redshift_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 2
}

aws_redshift_resource_policy_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_resource_policy"
}

# Aggregate all checks
allow if {
    aws_redshift_cluster_valid(input.resource_changes)
    aws_redshift_resource_policy_valid(input.resource_changes)
}

main if {
    allow
}
# Task 149


Create a RedShift cluster with 2 nodes and create an endpoint access for it

## Intent

Create a cluster and a endpoint associated with it

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "example_vpc" {
  cidr_block          = "10.0.0.0/16"
  enable_dns_support  = true
  enable_dns_hostnames = true
}

data "aws_availability_zones" "azs" {
    state = "available"
}

resource "aws_subnet" "subnet_a" {
  vpc_id                = aws_vpc.example_vpc.id
  cidr_block            = "10.0.1.0/24"
  availability_zone     = data.aws_availability_zones.azs.names[0]
  map_public_ip_on_launch = true
}

resource "aws_subnet" "subnet_b" {
  vpc_id                = aws_vpc.example_vpc.id
  cidr_block            = "10.0.2.0/24"
  availability_zone     = data.aws_availability_zones.azs.names[1]
  map_public_ip_on_launch = true
}

# Create the Redshift subnet group
resource "aws_redshift_subnet_group" "example_subnet_group" {
  name        = "example-subnet-group"
  description = "Example Redshift subnet group"

  subnet_ids = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "redshift-cluster-1"
  node_type          = "dc2.large"
  cluster_type       = "multi-node"
  number_of_nodes    = 2

  database_name = "mydb"
  master_username = "foo"
  master_password = "Mustbe8characters"

  skip_final_snapshot = true
}

resource "aws_redshift_endpoint_access" "example" {
  endpoint_name      = "example"
  subnet_group_name  = aws_redshift_subnet_group.example_subnet_group.id
  cluster_identifier = aws_redshift_cluster.example.cluster_identifier
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS Redshift cluster with 2 nodes is being created
aws_redshift_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 2
}

# Check if AWS Redshift endpoint access is being created
aws_redshift_endpoint_access_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_endpoint_access"
}

# Aggregate all checks
allow if {
    aws_redshift_cluster_valid(input.resource_changes)
    aws_redshift_endpoint_access_valid(input.resource_changes)
}

main if {
    allow
}
# Task 150


Create an AWS Lambda function with an IAM role, an IAM policy document for assuming the role, and an archive file for the Lambda function code. The Lambda function should be triggered by a nodejs18 runtime, have a specific handler, and use a "lambda.js" as the source file for the code.

## Intent

Needs to have a defined IAM role. Data for a .zip file, with source file = lambda.js, function name can be anything. For the aws_lambda_function use the defined zip, function name, set handler to anything, and runtime to "nodejs.18x"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "iam_for_lambda" {
  name               = "iam_for_lambda"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "archive_file" "lambda" {
  type        = "zip"
  output_path = "${path.module}/lambda_function_payload.zip"

  source {
    content  = "exports.handler = async (event) => ({ statusCode: 200, body: 'OK' });"
    filename = "lambda.js"
  }
}

resource "aws_lambda_function" "test_lambda" {
  filename      = "lambda_function_payload.zip"
  function_name = "lambda_function_name"
  role          = aws_iam_role.iam_for_lambda.arn
  handler       = "index.test"

  runtime = "nodejs18.x"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_iam_role_for_lambda_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_lambda_function_valid(resources) if {
    some resource in resources
    resource.type == "aws_lambda_function"
    resource.change.after.runtime == "nodejs18.x"
    resource.change.after.handler == "index.test"
    resource.change.after.filename == "lambda_function_payload.zip"
}

allow if {
    aws_iam_role_for_lambda_valid(input.resource_changes)
    aws_lambda_function_valid(input.resource_changes)
}

main if {
    allow
}
# Task 151


Create a Lambda function URL resource for an aws_lambda_function called "example_lambda

## Intent

Needs an aws_lambda_function defined(IAM role, zip). aws_lambda_function_url must have an authorization and the lambda function

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "iam_for_lambda" {
  name               = "iam_for_lambda"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "archive_file" "lambda" {
  type        = "zip"
  output_path = "${path.module}/lambda_function_payload.zip"

  source {
    content  = "exports.handler = async (event) => ({ statusCode: 200, body: 'OK' });"
    filename = "lambda.js"
  }
}

resource "aws_lambda_function" "example_lambda" {
  filename      = "lambda_function_payload.zip"
  function_name = "lambda_function_name"
  role          = aws_iam_role.iam_for_lambda.arn
  handler       = "index.test"

  runtime = "nodejs18.x"
}

resource "aws_lambda_function_url" "test_latest" {
  function_name      = aws_lambda_function.example_lambda.function_name
  authorization_type = "NONE"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for Lambda Function URL Resource
aws_lambda_function_url_valid(resources) if {
    some resource in resources
    resource.type == "aws_lambda_function_url"
    resource.change.after.function_name == "lambda_function_name"
}

# Check for AWS Lambda Function named "example_lambda"
aws_lambda_function_example_lambda_valid(resources) if {
    some resource in resources
    resource.type == "aws_lambda_function"
    resource.name == "example_lambda"
}

# Aggregate all checks
allow if {
    aws_lambda_function_url_valid(input.resource_changes)
    aws_lambda_function_example_lambda_valid(input.resource_changes)
}

main if {
    allow
}
# Task 152


Create an AWS lambda function called "example_lambda", and invoke the "example_lambda" lambda_function.

## Intent

Needs to have an aws_lambda_function defined (IAM role, zip). Use aws_lambda_invocation on the delcared aws_lambda_function

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "iam_for_lambda" {
  name               = "iam_for_lambda"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "archive_file" "lambda" {
  type        = "zip"
  output_path = "${path.module}/lambda_function_payload.zip"

  source {
    content  = "exports.handler = async (event) => ({ statusCode: 200, body: 'OK' });"
    filename = "lambda.js"
  }
}

resource "aws_lambda_function" "example_lambda" {
  filename      = "lambda_function_payload.zip"
  function_name = "lambda_function_name"
  role          = aws_iam_role.iam_for_lambda.arn
  handler       = "index.test"

  runtime = "nodejs18.x"
}

resource "aws_lambda_invocation" "example" {
  function_name = aws_lambda_function.example_lambda.function_name

  input = jsonencode({
    key1 = "value1"
    key2 = "value2"
  })
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for Lambda Function URL Resource
aws_lambda_invocation_valid(resources) if {
    some resource in resources
    resource.type == "aws_lambda_invocation"
}

aws_lambda_function_valid(resources) if {
    some resource in resources
    resource.type == "aws_lambda_function"
}

# Aggregate all checks
allow if {
    aws_lambda_invocation_valid(input.resource_changes)
    aws_lambda_function_valid(input.resource_changes)
}

main if {
    allow
}
# Task 153


Create a Lambda function alias for aws_lambda_function

## Intent

Needs to have an aws_lambda_function defined (IAM role, zip). Use aws_lambda_alias (need name, function_name, function_version)

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region  = "us-east-1"
}

resource "aws_dynamodb_table" "example_table" {
  name           = "example_table"
  hash_key       = "id"
  read_capacity  = 10
  write_capacity = 10

  attribute {
    name = "id"
    type = "S"
  }

  # Enable DynamoDB Streams
  stream_enabled   = true
  stream_view_type = "NEW_AND_OLD_IMAGES" # Choose as per your requirement

  # Other configurations for your table
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "iam_for_lambda" {
  name               = "iam_for_lambda"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

resource "aws_iam_policy" "lambda_dynamodb_policy" {
  name   = "lambda-dynamodb-policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "dynamodb:GetItem",
          "dynamodb:PutItem",
          "dynamodb:UpdateItem",
          "dynamodb:DeleteItem"
        ]
        Effect   = "Allow"
        Resource = aws_dynamodb_table.example_table.arn
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "lambda_policy_attach" {
  role       = aws_iam_role.iam_for_lambda.name
  policy_arn = aws_iam_policy.lambda_dynamodb_policy.arn
}

data "archive_file" "lambda" {
  type        = "zip"
  output_path = "${path.module}/app.zip"

  source {
    content  = "exports.handler = async (event) => ({ statusCode: 200, body: 'OK' });"
    filename = "app.js"
  }
}

resource "aws_lambda_function" "example_lambda" {
  filename      = data.archive_file.lambda.output_path
  function_name = "lambda_app_function"
  source_code_hash = data.archive_file.lambda.output_base64sha256
  role          = aws_iam_role.iam_for_lambda.arn
  handler       = "app.handler"
  runtime       = "nodejs18.x"
}

resource "aws_lambda_alias" "test_lambda_alias" {
  name             = "my_alias"
  description      = "a sample description"
  function_name    = aws_lambda_function.example_lambda.arn
  function_version = "$LATEST"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for Lambda Function URL Resource
aws_lambda_alias_valid(resources) if {
    some resource in resources
    resource.type == "aws_lambda_alias"
}

aws_lambda_function_valid(resources) if {
    some resource in resources
    resource.type == "aws_lambda_function"
}

# Aggregate all checks
allow if {
    aws_lambda_alias_valid(input.resource_changes)
    aws_lambda_function_valid(input.resource_changes)
}

main if {
    allow
}
# Task 155


Create a Lambda Layer Version resource from "lambda_layer_payload.zip"

## Intent

Create a aws_lambda_layer_version by using file_name = "lambda_layer_payload.zip". Layer name can be any.

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_lambda_layer_version" "lambda_layer" {
  filename   = "lambda_layer_payload.zip"
  layer_name = "lambda_layer_name"

  compatible_runtimes = ["nodejs16.x"]
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if the AWS Lambda Layer Version is valid
aws_lambda_layer_version_valid(resources) if {
    some resource in resources
    resource.type == "aws_lambda_layer_version"
    resource.change.after.filename == "lambda_layer_payload.zip"
}

# Aggregate all checks
allow if {
    aws_lambda_layer_version_valid(input.resource_changes)
}

main if {
    allow
}
# Task 156


Create a Lambda function and invoke it every 15 minutes

## Intent

Needs to have an aws_lambda_function defined. Create a aws_cloudwatch_event_rule to trigger every 15 minutes and aws_lambda_permission to have permission to run lambda function. Create a target to trigger the lambda function.

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_cloudwatch_event_rule" "lambda_schedule" {
  name        = "lambda-schedule-rule"
  description = "Invoke Lambda function every 15 minutes"
  schedule_expression = "rate(15 minutes)"
  role_arn = aws_iam_role.cron.arn
}

# Create a CloudWatch Events Target to associate with the Lambda function
resource "aws_cloudwatch_event_target" "lambda_target" {
  rule = aws_cloudwatch_event_rule.lambda_schedule.name
  arn = aws_lambda_function.cron.arn
}

data "archive_file" "lambda-func" {
  type        = "zip"
  output_path = "${path.module}/lambda_func.zip"

  source {
    content  = "def handler(event, context): return {'statusCode': 200}"
    filename = "lambda_func.py"
  }
}

resource "aws_lambda_function" "cron" {
  function_name = "cron-lambda-function"
  role          = aws_iam_role.cron.arn
  filename      = data.archive_file.lambda-func.output_path
  source_code_hash = data.archive_file.lambda-func.output_base64sha256
  handler       = "lambda_func.handler"
  runtime       = "python3.12"
}

resource "aws_lambda_permission" "cron" {
  function_name = aws_lambda_function.cron.function_name
  action        = "lambda:InvokeFunction"
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.lambda_schedule.arn
}

data "aws_iam_policy_document" "cron_assume_role" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type = "Service"
      identifiers = [
        "lambda.amazonaws.com",
        "events.amazonaws.com"
      ]
    }
  }
}

resource "aws_iam_role" "cron" {
  name               = "cron_assume_role"
  assume_role_policy = data.aws_iam_policy_document.cron_assume_role.json
}

resource "aws_iam_role_policy_attachment" "cron" {
  role       = aws_iam_role.cron.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS Lambda function is being created
aws_lambda_function_created(resources) if {
    some resource in resources
    resource.type == "aws_lambda_function"
}

# Check if CloudWatch Event Rule is set to invoke Lambda every 15 minutes
cloudwatch_event_rule_for_lambda_valid(resources) if {
    some resource in resources
    resource.type == "aws_cloudwatch_event_rule"
    resource.change.after.schedule_expression == "rate(15 minutes)"
}

# Aggregate all checks
allow if {
    aws_lambda_function_created(input.resource_changes)
    cloudwatch_event_rule_for_lambda_valid(input.resource_changes)
}

main if {
    allow
}
# Task 158


Create an AWS Lambda function to run a file"lambda.js". Define the IAM roles as needed

## Intent

Create aws_lambda_function (IAM, zip).

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "iam_for_lambda" {
  name               = "iam_for_lambda"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "archive_file" "lambda" {
  type        = "zip"
  output_path = "${path.module}/lambda_function_payload.zip"

  source {
    content  = "exports.handler = async (event) => ({ statusCode: 200, body: 'OK' });"
    filename = "lambda.js"
  }
}

resource "aws_lambda_function" "test_lambda" {
  filename      = "lambda_function_payload.zip"
  function_name = "lambda_function_name"
  role          = aws_iam_role.iam_for_lambda.arn
  handler       = "index.test"

  runtime = "nodejs18.x"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS IAM Role for Lambda is being created
aws_iam_role_lambda_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
    contains(resource.change.after.assume_role_policy, "lambda.amazonaws.com")
}

# Check if AWS Lambda function is being created
aws_lambda_function_valid(resources) if {
    some resource in resources
    resource.type == "aws_lambda_function"
    # Check for the specific file name and handler
}

# Aggregate all checks
allow if {
    aws_iam_role_lambda_valid(input.resource_changes)
    aws_lambda_function_valid(input.resource_changes)
}

main if {
    allow
}
# Task 159


Create an AWS Lambda function to run a file"lambda.js"

## Intent

Create aws_lambda_function (IAM, zip).

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "iam_for_lambda" {
  name               = "iam_for_lambda"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "archive_file" "lambda" {
  type        = "zip"
  output_path = "${path.module}/lambda_function_payload.zip"

  source {
    content  = "exports.handler = async (event) => ({ statusCode: 200, body: 'OK' });"
    filename = "lambda.js"
  }
}

resource "aws_lambda_function" "test_lambda" {
  filename      = "lambda_function_payload.zip"
  function_name = "lambda_function_name"
  role          = aws_iam_role.iam_for_lambda.arn
  handler       = "index.test"

  runtime = "nodejs18.x"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS IAM Role for Lambda is being created
aws_iam_role_lambda_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
    contains(resource.change.after.assume_role_policy, "lambda.amazonaws.com")
}

# Check if AWS Lambda function is being created
aws_lambda_function_valid(resources) if {
    some resource in resources
    resource.type == "aws_lambda_function"
    # Check for the specific file name and handler
}

# Aggregate all checks
allow if {
    aws_iam_role_lambda_valid(input.resource_changes)
    aws_lambda_function_valid(input.resource_changes)
}

main if {
    allow
}
# Task 160


Create a CloudWatch Composite Alarm resource.

## Intent

Creates an aws_cloudwatch_composite_alarm which requires at least one other aws_cloudwatch_metric_alarm

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_cloudwatch_composite_alarm" "example" {
  alarm_name        = "example-composite-alarm"

  alarm_rule = <<EOF
ALARM(${aws_cloudwatch_metric_alarm.foobar.alarm_name})
EOF

}

resource "aws_cloudwatch_metric_alarm" "foobar" {
  alarm_name                = "terraform-test-foobar5"
  comparison_operator       = "GreaterThanOrEqualToThreshold"
  evaluation_periods        = "2"
  metric_name               = "CPUUtilization"
  namespace                 = "AWS/EC2"
  period                    = "120"
  statistic                 = "Average"
  threshold                 = "80"
  alarm_description         = "This metric monitors ec2 cpu utilization"
  insufficient_data_actions = []
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS CloudWatch Composite Alarm is being created
aws_cloudwatch_composite_alarm_valid(resources) if {
    some resource in resources
    resource.type == "aws_cloudwatch_composite_alarm"
}

# Aggregate all checks
allow if {
    aws_cloudwatch_composite_alarm_valid(input.resource_changes)
}

main if {
    allow
}
# Task 161


Create a CloudWatch Metric Alarm resource.

## Intent

Createsr a aws_cloudwatch_metric_alarm

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_cloudwatch_metric_alarm" "foobar" {
  alarm_name                = "terraform-test-foobar5"
  comparison_operator       = "GreaterThanOrEqualToThreshold"
  evaluation_periods        = 2
  metric_name               = "CPUUtilization"
  namespace                 = "AWS/EC2"
  period                    = 120
  statistic                 = "Average"
  threshold                 = 80
  alarm_description         = "This metric monitors ec2 cpu utilization"
  insufficient_data_actions = []
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS CloudWatch Composite Alarm is being created
aws_cloudwatch_composite_alarm_valid(resources) if {
    some resource in resources
    resource.type == "aws_cloudwatch_metric_alarm"
}

# Aggregate all checks
allow if {
    aws_cloudwatch_composite_alarm_valid(input.resource_changes)
}

main if {
    allow
}