iac-eval-v2/iac-eval-v2 huggingface dataset:
# Task 227


Create a DAX cluster.

## Intent

has one "aws_dax_cluster"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_iam_role" "example" {
name = "test_role"

# Terraform's "jsonencode" function converts a
# Terraform expression result to valid JSON syntax.
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Sid = ""
Principal = {
Service = "dax.amazonaws.com"
}
},
]
})
}

resource "aws_dax_cluster" "bar" {
cluster_name = "cluster-example"
iam_role_arn = aws_iam_role.example.arn
node_type = "dax.r4.large"
replication_factor = 1
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for DAX cluster creation
dax_cluster_created(resources) if {
some resource in resources
resource.type == "aws_dax_cluster"
resource.change.actions[_] == "create"
}

# Allow DAX cluster creation
allow if {
dax_cluster_created(input.resource_changes)
}

main if {
    allow
}
# Task 228


Create a DAX parameter group.

## Intent

Has one "aws_dax_parameter_group"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_dax_parameter_group" "example" {
name = "example"

parameters {
name = "query-ttl-millis"
value = "100000"
}

parameters {
name = "record-ttl-millis"
value = "100000"
}
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for DAX parameter group creation
dax_parameter_group_created(resources) if {
some resource in resources
resource.type == "aws_dax_parameter_group"
resource.change.actions[_] == "create"
}

# Allow DAX parameter group creation with specific parameters
allow if {
dax_parameter_group_created(input.resource_changes)
}

main if {
    allow
}
# Task 229


Create a DAX subnet group.

## Intent

Has one "aws_dax_subnet_group"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}


resource "aws_subnet" "example1" {
cidr_block = "192.168.0.0/24"
vpc_id = aws_vpc.vpc.id
}

resource "aws_subnet" "example2" {
cidr_block = "192.168.1.0/24"
vpc_id = aws_vpc.vpc.id
}

resource "aws_dax_subnet_group" "example" {
name = "example"
subnet_ids = [aws_subnet.example1.id, aws_subnet.example2.id]
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for DAX subnet group creation
dax_subnet_group_created(resources) if {
some resource in resources
resource.type == "aws_dax_subnet_group"
resource.change.actions[_] == "create"
}

# Allow DAX subnet group creation with sufficient subnets
allow if {
dax_subnet_group_created(input.resource_changes)
}

main if {
    allow
}
# Task 230


Enable point-in-time recovery for the DynamoDB table.

## Intent

Has one "aws_dynamodb_table" resource
with one "point_in_time_recovery" with "enabled" = true

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
region = "us-east-1" # Change to your desired AWS region
}

resource "aws_dynamodb_table" "example" {
name = "your-dynamodb-table-name"
billing_mode = "PAY_PER_REQUEST" # Or "PROVISIONED" if you prefer provisioned capacity
hash_key = "id"
attribute {
name = "id"
type = "S"
}

point_in_time_recovery {
enabled = true # Set to true to enable point-in-time recovery
}

# Define other table settings as needed
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for DynamoDB table creation or update
dynamodb_table_modified(resources) if {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

# Check if point-in-time recovery is enabled
point_in_time_recovery_enabled(resource) if {
resource.type == "aws_dynamodb_table"
resource.change.after.point_in_time_recovery[_].enabled == true
}

# Allow if DynamoDB table is modified and point-in-time recovery is enabled
allow if {
dynamodb_table_modified(input.resource_changes)
some resource in input.resource_changes
point_in_time_recovery_enabled(resource)
}

main if {
    allow
}
# Task 231


Configure a custom Time to Live (TTL) attribute for data expiration.

## Intent

Has one "aws_dynamodb_table" resource
with one "ttl"
with one "attribute_name" = "custom_ttl_attribute"
with one "enabled" = true

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
region = "us-east-1" # Change to your desired AWS region
}

resource "aws_dynamodb_table" "example" {
name = "your-dynamodb-table-name"
billing_mode = "PAY_PER_REQUEST" # Or "PROVISIONED" if you prefer provisioned capacity
hash_key = "id"
attribute {
name = "id"
type = "S"
}

# Define other table settings as needed

ttl {
attribute_name = "custom_ttl_attribute" # Replace with your custom TTL attribute name
enabled = true # Set to true to enable TTL on the table
}
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for DynamoDB table creation or update
dynamodb_table_modified(resources) if {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

# Check if TTL is enabled with the correct attribute name
ttl_configured(resource) if {
resource.type == "aws_dynamodb_table"
resource.change.after.ttl[_].enabled == true
resource.change.after.ttl[_].attribute_name == "custom_ttl_attribute"
}

# Allow if DynamoDB table is modified and TTL is configured correctly
allow if {
dynamodb_table_modified(input.resource_changes)
some resource in input.resource_changes
ttl_configured(resource)
}

main if {
    allow
}
# Task 232


Configure a DynamoDB table with server-side encryption enabled.

## Intent

Has one "aws_dynamodb_table" resource
with one "server_side_encryption"
with one "enabled" = true

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_dynamodb_table" "example" {
name = "your-dynamodb-table-name"
billing_mode = "PAY_PER_REQUEST" # Or "PROVISIONED" if you prefer provisioned capacity
hash_key = "id"
attribute {
name = "id"
type = "S"
}

# Define other table settings as needed

server_side_encryption {
enabled = true
}
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

dynamodb_table_modified(resources) if {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

encryption_at_rest_enabled(resource) if {
resource.type == "aws_dynamodb_table"
resource.change.after.server_side_encryption[_].enabled == true
}

allow if {
dynamodb_table_modified(input.resource_changes)
some resource in input.resource_changes
encryption_at_rest_enabled(resource)
}

main if {
    allow
}
# Task 233


Create a DynamoDB table with data encryption at rest enabled for the table.

## Intent

Has one "aws_dynamodb_table" resource
with one "stream_enabled" = true
with one "stream_view_type" = "NEW_AND_OLD_IMAGES"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
region = "us-east-1" # Change this to your desired AWS region
}

resource "aws_dynamodb_table" "example" {
name = "your-dynamodb-table-name"
billing_mode = "PAY_PER_REQUEST" # Or "PROVISIONED" if you prefer provisioned capacity
hash_key = "id"
attribute {
name = "id"
type = "S"
}

# Define other table settings as needed

stream_enabled = true # Enable streams
stream_view_type = "NEW_AND_OLD_IMAGES" # Choose the appropriate stream view type
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for DynamoDB table creation or update
dynamodb_table_modified(resources) if {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

# Check if stream is enabled with new and old images
stream_configured(resource) if {
resource.type == "aws_dynamodb_table"
resource.change.after.stream_enabled == true
resource.change.after.stream_view_type == "NEW_AND_OLD_IMAGES" 
}

# Allow if DynamoDB table is modified and stream is configured correctly
allow if {
dynamodb_table_modified(input.resource_changes)
some resource in input.resource_changes
stream_configured(resource)
}

main if {
    allow
}
# Task 234


Create an AWS VPC resource with an example CIDR block and IPv6 enabled

## Intent

Has one resource "aws_vpc"        
with one "cidr_block" with any valid IPv4 address
with one "assign_generated_ipv6_cidr_block" with value "true"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  assign_generated_ipv6_cidr_block = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1
default valid := false

valid if {
	some changed_resource in input.resource_changes
	changed_resource.type == "aws_vpc"
	"create" in changed_resource.change.actions
	args := changed_resource.change.after
	net.cidr_is_valid(args.cidr_block)
	args.assign_generated_ipv6_cidr_block == true
}

main if {
    valid
}
# Task 265


Create a basic AWS IAM group example

## Intent

Has one "aws_iam_group" resource
with one "name" with any value

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_iam_group" "group" {
  name = "my-group"
  path = "/users/"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1
default valid := false

valid if {
    some group_resource in input.resource_changes
    group_resource.type == "aws_iam_group"
}

main if {
    valid
}
# Task 266


Create a basic AWS IAM user example

## Intent

Has one "aws_iam_user" resource
with one "name" with any value

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_iam_user" "lb" {
  name = "loadbalancer"
  path = "/system/"

  tags = {
    tag-key = "tag-value"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1
default valid := false

valid if {
	some user_resource in input.resource_changes
	user_resource.type == "aws_iam_user"
}

main if {
    valid
}
# Task 267


Create a basic AWS IAM Virtual MFA Device resource

## Intent

Has one "aws_iam_virtual_mfa_device" resource
with one "virtual_mfa_device_name" with any string

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_iam_virtual_mfa_device" "example" {
  virtual_mfa_device_name = "example"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1
default valid := false

valid if {
	some mfa in input.resource_changes
	mfa.type == "aws_iam_virtual_mfa_device"
}

main if {
    valid
}
# Task 268


Create a S3 bucket with an example name

## Intent

Has an aws_s3_bucket resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_s3_bucket" "example" {
  bucket = "my-tf-test-bucket"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1
default valid := false

valid if {
        some bucket in input.resource_changes
        bucket.type == "aws_s3_bucket"
}

main if {
    valid
}
# Task 269


Create an AWS resource to help me store images that I want to display on my website

## Intent

Has an aws_s3_bucket resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_s3_bucket" "example-bucket" {
  bucket = "test-bucket"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1
default valid := false

valid if {
    some bucket in input.resource_changes
    bucket.type == "aws_s3_bucket"
}

main if {
    valid
}
# Task 325


Create aws RDS with randomly generated id and password

## Intent

Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"
    with skip_final_snapshot = true
    with identifier generated from random_id
    with password generated from random_password

has one random_id resrource

has one random_password resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region="us-east-1"
}

resource "random_id" "suffix" {
  byte_length = 4
}

resource "random_password" "db" {
  length  = 16
  special = false
}

resource "aws_db_instance" "test" {
  identifier          = "metricbeat-test-${random_id.suffix.hex}"
  allocated_storage   = 20 // Gigabytes
  engine              = "mysql"
  instance_class      = "db.t2.micro"
  db_name                = "metricbeattest"
  username            = "foo"
  password            = random_password.db.result
  skip_final_snapshot = true // Required for cleanup
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_configuration_valid = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    after.allocated_storage != null
    after.engine != null
    after.username != null
    is_valid_engine(after.engine)
    is_valid_instance_class(after.instance_class)
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

has_one_random_id if {
    resource := input.resource_changes[_]
    resource.type == "random_id"
}

has_one_random_password if {
    resource := input.resource_changes[_]
    resource.type == "random_password"
}

is_configuration_valid if {
    is_valid_db_instance
    has_one_random_id
    has_one_random_password
}

main if {
    is_valid_db_instance
    is_configuration_valid
}
# Task 326


Create an 20GB mysql on aws with randomly generated id and password

## Intent

Has one "aws_db_instance" resource
    with one "allocated_storage" = 20
    with one "engine" = mysql
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"
    with skip_final_snapshot = true
    with identifier generated from random_id
    with password generated from random_password

has one random_id resrource

has one random_password resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region="us-east-1"
}

resource "random_id" "suffix" {
  byte_length = 4
}

resource "random_password" "db" {
  length  = 16
  special = false
}

resource "aws_db_instance" "test" {
  identifier          = "metricbeat-test-${random_id.suffix.hex}"
  allocated_storage   = 20 // Gigabytes
  engine              = "mysql"
  instance_class      = "db.t2.micro"
  db_name                = "metricbeattest"
  username            = "foo"
  password            = random_password.db.result
  skip_final_snapshot = true // Required for cleanup
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_configuration_valid = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    after.allocated_storage == 20
    after.engine == "mysql"
    after.username != null
    is_valid_engine(after.engine)
    is_valid_instance_class(after.instance_class)
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

has_one_random_id if {
    resource := input.resource_changes[_]
    resource.type == "random_id"
}

has_one_random_password if {
    resource := input.resource_changes[_]
    resource.type == "random_password"
}

is_configuration_valid if {
    is_valid_db_instance
    has_one_random_id
    has_one_random_password
}

main if {
    is_valid_db_instance
    is_configuration_valid
}
# Task 351


defines an AWS RDS option group named "option-group-pike" with major engine version 11, and use the sqlserver-ee engine

## Intent

Has one "aws_db_option_group" resource
    with one "engine_name" = "sqlserver-ee"
    with one "major_engine_version" = "11.00"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_option_group" "example" {
  name                     = "option-group-pike"
  option_group_description = "Terraform Option Group"
  engine_name              = "sqlserver-ee"
  major_engine_version     = "11.00"

  option {
    db_security_group_memberships  = []
    option_name                    = "SQLSERVER_AUDIT"
    port                           = 0
    vpc_security_group_memberships = []

    option_settings {
      name  = "IAM_ROLE_ARN"
      value = "arn:aws:iam::680235478471:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS"
    }
    option_settings {
      name  = "S3_BUCKET_ARN"
      value = "arn:aws:s3:::testbucketineu-west2/rds"
    }
  }

  option {
    option_name = "TDE"
    port        = 0
  }

  tags = {
    pike = "permissions"
  }
}


## OPA Rego validation policy

package terraform.policy 

import rego.v1

default is_valid_db_option_group = false

# Regex pattern to match "11", "11.0", "11.00", etc.
pattern := `^11(\.0+)?$`

# Validate aws_db_option_group resource
is_valid_db_option_group if {
    some i
    resource := input.resource_changes[i]
    resource.type == "aws_db_option_group"
    resource.change.after.engine_name == "sqlserver-ee"
    major_engine_version_value := resource.change.after.major_engine_version
    is_valid_version(major_engine_version_value)
    resource.change.after.name == "option-group-pike"
}

# Helper function to check if the version matches the regex pattern
is_valid_version(version) if {
    regex.match(pattern, sprintf("%v", [version]))
}

main if {
    is_valid_db_option_group
}
# Task 359


Generate a basic Amazon Lightsail instance in the `eu-west-1` region (use availability zone `eu-west-1a`).

## Intent

have one "aws_lightsail_instance" resource
    with "name" argument
    with "availability_zone" argument
    with "blueprint_id" argument
    with "bundle_id" argument

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region     = "eu-west-1"
}

resource "aws_lightsail_instance" "custom" {
  name              = "custom"
  availability_zone = "eu-west-1a"
  blueprint_id      = "amazon_linux_2"
  bundle_id         = "nano_2_0"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_lightsail_instance = false

is_valid_lightsail_instance if {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_lightsail_instance"
    has_required_arguments(resource.values)
}

has_required_arguments(values) if {
    values.name
    values.availability_zone
    values.blueprint_id
    values.bundle_id
}

main if {
    is_valid_lightsail_instance
}
# Task 360


Generate a basic Amazon Lightsail instance with user data in the `eu-west-1` region (use availability zone `eu-west-1a`).

## Intent

have one "aws_lightsail_instance" resource
    with "name" argument
    with "availability_zone" argument
    with "blueprint_id" argument
    with "bundle_id" argument
    with "user_data" argument

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region     = "eu-west-1"
}

resource "aws_lightsail_instance" "custom" {
  name              = "custom"
  availability_zone = "eu-west-1a"
  blueprint_id      = "amazon_linux_2"
  bundle_id         = "nano_1_0"
  user_data         = "sudo yum install -y httpd && sudo systemctl start httpd && sudo systemctl enable httpd && echo '<h1>Deployed via Terraform</h1>' | sudo tee /var/www/html/index.html"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

# aws_lightsail_instance attributes - optional

default lightsail_instance_valid := false

lightsail_instance_valid if {
	instance := input.resource_changes[_]
	instance.type == "aws_lightsail_instance"
    expressions := instance.expressions

    # Validate the presence of required arguments
    expressions.name
    expressions.availability_zone
    expressions.blueprint_id
    expressions.bundle_id
    expressions.user_data
}

# You can add more specific validations here if needed.
# For example, if you want to check if the name follows a specific format,
# you could write a rule like this:

name_is_valid if {
	instance := input.resource_changes[_]
	instance.type == "aws_lightsail_instance"
	regex.match("^[a-zA-Z0-9-_]+$", instance.change.after.name)
}

main if {
    lightsail_instance_valid
    name_is_valid
}