iac-eval-v2/iac-eval-v2 huggingface dataset:
# Task 409


Create a db.t4g.large AWS PostgresSQL

## Intent

Has one "aws_db_instance" resource
with one "allocated_storage" minimun value is 20
with one "engine" with value "postgres"
with one "instance_class" with value "db.t4g.large"
with one "password"
with one "username"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "postgres"
  instance_class       = "db.t4g.large"
  username             = "foo"
  password             = "foobarbaz"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
}

requirement1(after) if {
    after.allocated_storage >= 20
    after.engine == "postgres"
    after.username != null
    is_valid_engine(after.engine)
}

requirement2(after) if {
    after.instance_class == "db.t4g.large"
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.password != null
}

requirement3(after) if {
    after.manage_master_user_password == true
}

requirement3(after) if {
    after.snapshot_identifier != null
}

requirement3(after) if {
    after.replicate_source_db != null
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
}
# Task 410


create a memory optimized PostgresSQL

## Intent

Has one "aws_db_instance" resource
with one "allocated_storage" minimun value is 20
with one "engine" with value "postgres"
with one "instance_class" with valid memory-optimized class
with one "password"
with one "username"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "postgres"
  instance_class       = "db.z1d.micro"
  username             = "foo"
  password             = "foobarbaz"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
}

requirement1(after) if {
    after.allocated_storage >= 20
    after.engine == "postgres"
    after.username != null
    is_valid_engine(after.engine)
}

requirement2(after) if {
    after.instance_class != null
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.password != null
}

requirement3(after) if {
    after.manage_master_user_password == true
}

requirement3(after) if {
    after.snapshot_identifier != null
}

requirement3(after) if {
    after.replicate_source_db != null
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
}
# Task 411


Create an AWS mySQL instance. Any changes on it will be applied immediately

## Intent

Has one "aws_db_instance" resource
with one "allocated_storage"
with one "engine" with value "mysql"
with one "instance_class" 
with one "password"
with one "username"
with one "apply_immediately" set to true

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.z1d.micro"
  username             = "foo"
  password             = "foobarbaz"
  apply_immediately = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
    after.apply_immediately == true
}

requirement1(after) if {
    after.allocated_storage != null
    after.engine != null
    after.username != null
    is_valid_engine(after.engine)
}

requirement1(after) if {
    after.snapshot_identifier != null
}

requirement1(after) if {
    after.replicate_source_db != null
}

requirement2(after) if {
    after.instance_class != null
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.password != null
}

requirement3(after) if {
    after.manage_master_user_password == true
}

requirement3(after) if {
    after.snapshot_identifier != null
}

requirement3(after) if {
    after.replicate_source_db != null
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
}
# Task 412


Create an AWS mySQL instance that skips the final snapshot

## Intent

Has one "aws_db_instance" resource
with one "allocated_storage"
with one "engine" with value "mysql"
with one "instance_class" 
with one "password"
with one "username"
with one "skip_final_snapshot" set to true

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.z1d.micro"
  username             = "foo"
  password             = "foobarbaz"
  skip_final_snapshot = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
    after.skip_final_snapshot == true
}

requirement1(after) if {
    after.allocated_storage != null
    after.engine != null
    after.username != null
    is_valid_engine(after.engine)
}

requirement1(after) if {
    after.snapshot_identifier != null
}

requirement1(after) if {
    after.replicate_source_db != null
}

requirement2(after) if {
    after.instance_class != null
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.password != null
}

requirement3(after) if {
    after.manage_master_user_password == true
}

requirement3(after) if {
    after.snapshot_identifier != null
}

requirement3(after) if {
    after.replicate_source_db != null
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
}
# Task 414


create a aws relational database from a snapshot

## Intent

Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_db_instance" "replica" {
  snapshot_identifier = "your identifier"
  instance_class       = "db.z1d.micro"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
}

requirement1(after) if {
    after.snapshot_identifier != null
}

requirement2(after) if {
    after.instance_class != null
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.password != null
}

requirement3(after) if {
    after.manage_master_user_password == true
}

requirement3(after) if {
    after.snapshot_identifier != null
}

requirement3(after) if {
    after.replicate_source_db != null
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
}
# Task 415


create a basic AWS RDS instance, with gp3 storage type

## Intent

Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  password             = "foobarbaz"
  storage_type        = "gp3"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
    after.storage_type == "gp3"
}

requirement1(after) if {
    after.allocated_storage >= 20
    after.allocated_storage <= 65536
    after.engine != null
    after.username != null
    is_valid_engine(after.engine)
}

requirement2(after) if {
    after.instance_class != null
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.password != null
}

requirement3(after) if {
    after.manage_master_user_password == true
}

requirement3(after) if {
    after.snapshot_identifier != null
}

requirement3(after) if {
    after.replicate_source_db != null
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
}
# Task 416


create a basic AWS RDS instance, with io1 storage type

## Intent

Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_db_instance" "default" {
  allocated_storage    = 100
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  password             = "foobarbaz"
  storage_type        = "io1"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
    after.storage_type == "io1"
}

requirement1(after) if {
    after.allocated_storage >= 100
    after.allocated_storage <= 65536
    after.engine != null
    after.username != null
    is_valid_engine(after.engine)
}

requirement2(after) if {
    after.instance_class != null
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.password != null
}

requirement3(after) if {
    after.manage_master_user_password == true
}

requirement3(after) if {
    after.snapshot_identifier != null
}

requirement3(after) if {
    after.replicate_source_db != null
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
}
# Task 418


create an AWS database that enables storage autoscaling

## Intent

Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"
    with one max_allocated_storage

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  password             = "foobarbaz"
  max_allocated_storage = 100
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
    after.max_allocated_storage > after.allocated_storage
}

requirement1(after) if {
    after.allocated_storage != null
    after.engine != null
    after.username != null
    is_valid_engine(after.engine)
}

requirement1(after) if {
    after.snapshot_identifier != null
}

requirement1(after) if {
    after.replicate_source_db != null
}

requirement2(after) if {
    after.instance_class != null
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.password != null
}

requirement3(after) if {
    after.manage_master_user_password == true
}

requirement3(after) if {
    after.snapshot_identifier != null
}

requirement3(after) if {
    after.replicate_source_db != null
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
}
# Task 419


create an aws database that Managed Master Passwords via Secrets Manager, default KMS Key

## Intent

Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "username"
    with one manage_master_user_password

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  manage_master_user_password = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
}

requirement1(after) if {
    after.allocated_storage != null
    after.engine != null
    after.username != null
    is_valid_engine(after.engine)
}

requirement1(after) if {
    after.snapshot_identifier != null
}

requirement1(after) if {
    after.replicate_source_db != null
}

requirement2(after) if {
    after.instance_class != null
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.manage_master_user_password == true
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
}
# Task 420


create an aws database that Managed Master Passwords via Secrets Manager, with specific KMS Key

## Intent

Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "username"
    with one manage_master_user_password
    with one "master_user_secret_kms_key_id"  
 
has one "aws_kms_key"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  manage_master_user_password = true
  master_user_secret_kms_key_id = aws_kms_key.example.key_id
}

resource "aws_kms_key" "example" {
  description = "Example KMS Key"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_db_instance = false
default is_valid_kms_key = false

is_valid_db_instance if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    has_required_db_arguments
}

is_valid_kms_key if {
    resource := input.resource_changes[_]
    resource.type == "aws_kms_key"
}

has_required_db_arguments if {
    resource := input.resource_changes[_]
    resource.type == "aws_db_instance"
    after := resource.change.after
    requirement1(after)
    requirement2(after)
    requirement3(after)
}

requirement1(after) if {
    after.allocated_storage != null
    after.engine != null
    after.username != null
    is_valid_engine(after.engine)
}

requirement1(after) if {
    after.snapshot_identifier != null
}

requirement1(after) if {
    after.replicate_source_db != null
}

requirement2(after) if {
    after.instance_class != null
    is_valid_instance_class(after.instance_class)
}

requirement3(after) if {
    after.password != null
}

requirement3(after) if {
    after.manage_master_user_password == true
}

requirement3(after) if {
    after.snapshot_identifier != null
}

requirement3(after) if {
    after.replicate_source_db != null
}

is_valid_engine(engine) if {
    engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
    engine_set[engine]
}

is_valid_instance_class(instance_class) if {
    startswith(instance_class, "db.")
}

main if {
    is_valid_db_instance
    is_valid_kms_key
}
# Task 441


creates an egress-only internet gateway named "pike" associated with a specified VPC, allowing IPv6-enabled instances to connect to the internet without allowing inbound internet traffic, and tags it with "permissions".

## Intent

Has one "aws_egress_only_internet_gateway" resource:
Associated with a specified "aws_vpc" resource
Designed to allow IPv6-enabled instances within the VPC to connect to the internet while preventing inbound internet traffic
Tagged with "permissions" to categorize or specify its role or access levels within the infrastructure

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_egress_only_internet_gateway" "pike" {
  vpc_id = "vpc-0c33dc8cd64f408c4"
  tags = {
    pike = "permissions"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_valid_egress_only_internet_gateway = false

is_valid_egress_only_internet_gateway if {
	some i
	resource := input.resource_changes[i]
	resource.type == "aws_egress_only_internet_gateway"
	has_vpc_id(resource)
	resource.change.after.tags != null
}

has_vpc_id(resource) if {
	resource.change.after.vpc_id != null
}

has_vpc_id(resource) if {
	resource.change.after_unknown.vpc_id == true
}

main if {
    is_valid_egress_only_internet_gateway
}