iac-eval-v2/iac-eval-v2 huggingface dataset:
# Task 111


Create a bucket "a". Then configure logging for the bucket to send access logs to another bucket named 'logging-680235478471' with a prefix of 'log/' in the target bucket.

## Intent

has one aws_s3_bucket resource
with bucket

has one aws_s3_bucket_logging resource
with bucket
with target_bucket
with target_prefix

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "a" {
  bucket = "testbucketineu-west2"
}

resource "aws_s3_bucket_logging" "example" {
  bucket        = "testbucketineu-west2"
  target_bucket = "logging-680235478471"
  target_prefix = "log/"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_s3_bucket = false

default has_s3_bucket_logging = false

default valid_configuration = false

has_s3_bucket if {
    bucket := input.planned_values.root_module.resources[_]
    bucket.type == "aws_s3_bucket"
    bucket.name == "a"
}

has_s3_bucket_logging if {
    logging := input.planned_values.root_module.resources[_]
    logging.type == "aws_s3_bucket_logging"
    logging.values.target_bucket == "logging-680235478471"
    logging.values.target_prefix == "log/"
}

valid_configuration if {
    has_s3_bucket
    has_s3_bucket_logging
}

main if {
    valid_configuration
}
# Task 112


Create an AWS S3 bucket named 'example-bucket' with object lock enabled. Configure object lock governance mode with a retention period of 90 days for objects in the bucket.

## Intent

has one aws_s3_bucket resource
with bucket

has one aws_s3_bucket_object_lock_configuration resource
with bucket
with rule
     with default_retention
          with mode (GOVERNANCE or COMPLIANCE)
          with days or years

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "example-bucket"
}

resource "aws_s3_bucket_object_lock_configuration" "example" {
  bucket = aws_s3_bucket.example.bucket

  rule {
    default_retention {
      mode  = "GOVERNANCE"
      days  = 90
    }
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_s3_bucket = false

default has_s3_bucket_object_lock_configuration = false

default valid_configuration = false


has_s3_bucket if {
    bucket := input.planned_values.root_module.resources[_]
    bucket.type == "aws_s3_bucket"
    bucket.values.bucket == "example-bucket"
}

has_s3_bucket_object_lock_configuration if {
    lock_config := input.planned_values.root_module.resources[_]
    lock_config.type == "aws_s3_bucket_object_lock_configuration"
    default_retention := lock_config.values.rule[_].default_retention[_]
    default_retention.mode == "GOVERNANCE"
    default_retention.days == 90
}

valid_configuration if {
    has_s3_bucket
    has_s3_bucket_object_lock_configuration
}

main if {
    valid_configuration
}
# Task 113


Create an AWS S3 bucket named 'example-bucket' with object lock enabled. Configure object lock compliance mode with a retention period of 30 days for objects in the bucket.

## Intent

has one aws_s3_bucket resource
with bucket

has one aws_s3_bucket_object_lock_configuration resource
with bucket
with rule
     with default_retention
          with mode (GOVERNANCE or COMPLIANCE)
          with days or years

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "example-bucket"
}

resource "aws_s3_bucket_object_lock_configuration" "example" {
  bucket = aws_s3_bucket.example.bucket

  rule {
    default_retention {
      mode  = "COMPLIANCE"
      days  = 30
    }
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_s3_bucket = false

default has_s3_bucket_object_lock_configuration = false

default valid_configuration = false


has_s3_bucket if {
    bucket := input.planned_values.root_module.resources[_]
    bucket.type == "aws_s3_bucket"
    bucket.values.bucket == "example-bucket"
}

has_s3_bucket_object_lock_configuration if {
    lock_config := input.planned_values.root_module.resources[_]
    lock_config.type == "aws_s3_bucket_object_lock_configuration"
    default_retention := lock_config.values.rule[_].default_retention[_]
    default_retention.mode == "COMPLIANCE"
    default_retention.days == 30
}

valid_configuration if {
    has_s3_bucket
    has_s3_bucket_object_lock_configuration
}

main if {
    valid_configuration
}
# Task 114


create a bucket 'pike-680235478471'. Set up request payment configuration for an AWS S3 bucket named 'pike-680235478471', specifying the payer as 'Requester'.

## Intent

has one aws_s3_bucket resource
with bucket

has one aws_s3_bucket_request_payment_configuration resource
with bucket
with payer (BucketOwner or Requester)

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "a" {
  bucket = "pike-680235478471"
}

resource "aws_s3_bucket_request_payment_configuration" "pike" {
  bucket = "pike-680235478471"
  payer  = "Requester"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_s3_bucket = false

default has_s3_bucket_request_payment_configuration = false

default valid_configuration = false

has_s3_bucket if {
    some i
    bucket := input.planned_values.root_module.resources[i]
    bucket.type == "aws_s3_bucket"
    bucket.values.bucket == "pike-680235478471"
}

has_s3_bucket_request_payment_configuration if {
    some i
    payment_config := input.planned_values.root_module.resources[i]
    payment_config.type == "aws_s3_bucket_request_payment_configuration"
    payment_config.values.payer == "Requester"
}

valid_configuration if {
    has_s3_bucket
    has_s3_bucket_request_payment_configuration
}

main if {
    valid_configuration
}
# Task 115


Implement public access block settings for an AWS S3 bucket named 'pike-680235478471' to block public ACLs, public policies, and restrict public buckets.

## Intent

has one aws_s3_bucket resource
with bucket

has one aws_s3_bucket_public_access_block resource
with bucket
with block_public_acls (boolean)
with block_public_policy (boolean)
with ignore_public_acls (boolean)
with restrict_public_buckets (boolean)

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "a" {
  bucket = "pike-680235478471"
}

resource "aws_s3_bucket_public_access_block" "example" {
  bucket = "pike-680235478471"

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_s3_bucket = false

default has_s3_bucket_public_access_block = false

default valid_configuration = false

has_s3_bucket if {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_s3_bucket"
    resource.values.bucket == "pike-680235478471"
}

has_s3_bucket_public_access_block if {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_s3_bucket_public_access_block"
    resource.values.block_public_acls == true
    resource.values.block_public_policy == true
    resource.values.ignore_public_acls == true
    resource.values.restrict_public_buckets == true
}


valid_configuration if {
    has_s3_bucket
    has_s3_bucket_public_access_block
}

main if {
    valid_configuration
}
# Task 117


Create a Terraform configuration that defines an AWS S3 bucket, a private ACL for the bucket, and a bucket policy allowing s3:GetObject actions with a condition based on the AWS Referer header. The bucket should be named "my_unique_bucket_name," and the policy should grant access to all principals.

## Intent

Resource "aws_s3_bucket"
has one "bucket"

Resource "aws_s3_bucket_acl"
has one "bucket"
has one "acl"

Resource "aws_s3_bucket_policy"
has one "bucket"
has one "policy"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "my_bucket" {
  bucket = "my_unique_bucket_name"
}

resource "aws_s3_bucket_acl" "my_bucket_acl" {
  bucket = aws_s3_bucket.my_bucket.id
  acl    = "private"
}

resource "aws_s3_bucket_policy" "my_bucket_policy" {
  bucket = aws_s3_bucket.my_bucket.id
  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Sid       = "ExampleStatement1",
        Effect    = "Allow",
        Principal = "*",
        Action    = [
          "s3:GetObject"
        ],
        Resource = [
          "${aws_s3_bucket.my_bucket.arn}/*"
        ],
        Condition = {
          StringEquals = {
            "aws:Referer" = "http://www.example.com"
          }
        }
      }
    ]
  })
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_s3_bucket = false
default has_aws_s3_bucket_acl = false
default has_aws_s3_bucket_policy = false

has_aws_s3_bucket if {
    bucket := input.planned_values.root_module.resources[_]
    bucket.type == "aws_s3_bucket"
    bucket.values.bucket == "my_unique_bucket_name"
}

has_aws_s3_bucket_acl if {
    acl := input.planned_values.root_module.resources[_]
    acl.type == "aws_s3_bucket_acl"
    acl.values.acl == "private"
}

has_aws_s3_bucket_policy if {
    policy := input.planned_values.root_module.resources[_]
    policy.type == "aws_s3_bucket_policy"
}

valid_configuration if {
    has_aws_s3_bucket
    has_aws_s3_bucket_acl
    has_aws_s3_bucket_policy
}

main if {
    valid_configuration
}
# Task 119


Create a Terraform configuration that sets up an AWS S3 bucket named "mybucket" with versioning enabled. Additionally, configure object lock retention for compliance mode with a retention period of 5 days. Ensure that the object lock configuration is applied to the same bucket as versioning. Use appropriate resource types and dynamic references for bucket IDs and ARNs in the configuration.

## Intent

Resource "aws_s3_bucket"
has one "bucket"

Resource "aws_s3_bucket_versioning"
has one "bucket"
with one "status" in "versioning_configuration"

Resource "aws_s3_bucket_object_lock_configuration"
has one "bucket"
with one "mode" and "days" in "default_retention" within "rule"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_versioning" "example" {
  bucket = aws_s3_bucket.example.id

  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_object_lock_configuration" "example" {
  bucket = aws_s3_bucket.example.id

  rule {
    default_retention {
      mode = "COMPLIANCE"
      days = 5
    }
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_s3_bucket = false
default has_aws_s3_bucket_versioning = false
default has_aws_s3_bucket_object_lock_configuration = false

has_aws_s3_bucket if {
    bucket := input.planned_values.root_module.resources[_]
    bucket.type == "aws_s3_bucket"
    bucket.values.bucket == "mybucket"
}

has_aws_s3_bucket_versioning if {
    versioning := input.planned_values.root_module.resources[_]
    versioning.type == "aws_s3_bucket_versioning"
    versioning.values.versioning_configuration[_].status == "Enabled"
}

has_aws_s3_bucket_object_lock_configuration if {
    lock_config := input.planned_values.root_module.resources[_]
    lock_config.type == "aws_s3_bucket_object_lock_configuration"
    lock_config.values.rule[_].default_retention[_].mode == "COMPLIANCE"
    lock_config.values.rule[_].default_retention[_].days == 5
}

valid_configuration if {
    has_aws_s3_bucket
    has_aws_s3_bucket_versioning
    has_aws_s3_bucket_object_lock_configuration
}

main if {
    valid_configuration
}
# Task 120


Create a Terraform configuration for an AWS environment. Start by defining a KMS key with the description "This key is used to encrypt bucket objects" and a deletion window of 10 days. Next, define an S3 bucket named "mybucket". Finally, configure server-side encryption for the S3 bucket using the previously defined KMS key. The encryption should use the "aws:kms" algorithm. Include resource blocks for each component and ensure the bucket encryption references the KMS key's ARN and uses the KMS algorithm for encryption.

## Intent

Resource "aws_kms_key"
has one "description"
has one "deletion_window_in_days"

Resource "aws_s3_bucket"
has one "bucket"

Resource "aws_s3_bucket_server_side_encryption_configuration"
has one "bucket"
within "rule", it specifies:
"kms_master_key_id"
"sse_algorithm"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_kms_key" "mykey" {
  description             = "This key is used to encrypt bucket objects"
  deletion_window_in_days = 10
}

resource "aws_s3_bucket" "mybucket" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
  bucket = aws_s3_bucket.mybucket.id

  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = aws_kms_key.mykey.arn
      sse_algorithm     = "aws:kms"
    }
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_kms_key = false
default has_aws_s3_bucket = false
default has_aws_s3_bucket_server_side_encryption_configuration = false

has_aws_kms_key if {
    key := input.planned_values.root_module.resources[_]
    key.type == "aws_kms_key"
    key.values.description == "This key is used to encrypt bucket objects"
    key.values.deletion_window_in_days == 10
}

has_aws_s3_bucket if {
    bucket := input.planned_values.root_module.resources[_]
    bucket.type == "aws_s3_bucket"
    bucket.values.bucket == "mybucket"
}

has_aws_s3_bucket_server_side_encryption_configuration if {
    encryption_config := input.planned_values.root_module.resources[_]
    encryption_config.type == "aws_s3_bucket_server_side_encryption_configuration"
    rule := encryption_config.values.rule[_].apply_server_side_encryption_by_default[_]
    rule.sse_algorithm == "aws:kms"
}

valid_configuration if {
    has_aws_kms_key
    has_aws_s3_bucket
    has_aws_s3_bucket_server_side_encryption_configuration
}

main if {
    valid_configuration
}
# Task 121


Generate a Terraform configuration for managing AWS S3 resources. Start by creating an S3 bucket named "my-tf-example-bucket". Follow this with a configuration block for S3 bucket ownership controls, referencing the bucket's ID and setting the object ownership to "BucketOwnerPreferred". Then, define an S3 bucket ACL resource that depends on the successful application of the ownership controls. This ACL should set the bucket access to private and also reference the bucket's ID. Ensure each resource block is defined clearly and connected appropriately through references.

## Intent

Resource "aws_s3_bucket"
has one "bucket"

Resource "aws_s3_bucket_ownership_controls"
has one "bucket"
within "rule", it specifies:
"object_ownership"

Resource "aws_s3_bucket_acl"
has a dependency on "aws_s3_bucket_ownership_controls.example"
has one "bucket"
has one "acl"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "my-tf-example-bucket"
}

resource "aws_s3_bucket_ownership_controls" "example" {
  bucket = aws_s3_bucket.example.id
  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}

resource "aws_s3_bucket_acl" "example" {
  depends_on = [aws_s3_bucket_ownership_controls.example]

  bucket = aws_s3_bucket.example.id
  acl    = "private"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_s3_bucket = false
default has_aws_s3_bucket_ownership_controls = false
default has_aws_s3_bucket_acl = false

has_aws_s3_bucket if {
    bucket := input.planned_values.root_module.resources[_]
    bucket.type == "aws_s3_bucket"
    bucket.values.bucket == "my-tf-example-bucket"
}

has_aws_s3_bucket_ownership_controls if {
    ownership_controls := input.planned_values.root_module.resources[_]
    ownership_controls.type == "aws_s3_bucket_ownership_controls"
    ownership_controls.values.rule[_].object_ownership == "BucketOwnerPreferred"
}

has_aws_s3_bucket_acl if {
    acl := input.planned_values.root_module.resources[_]
    acl.type == "aws_s3_bucket_acl"
    acl.values.acl == "private"
}

valid_configuration if {
    has_aws_s3_bucket
    has_aws_s3_bucket_ownership_controls
    has_aws_s3_bucket_acl
}

main if {
    valid_configuration
}
# Task 122


Create a Terraform configuration for setting up AWS S3 buckets with specific access control and logging features. Start by defining two S3 buckets: one named "my-tf-example-bucket" and one named "my-tf-log-bucket". Next, establish access control for each bucket with predefined ACL settings, ensuring the example bucket is set to private and the log bucket is set to allow log delivery writes. Finally, configure S3 bucket logging for the example bucket to send its logs to the log bucket, with target prefix "log/". Ensure all resources are appropriately linked using their identifiers and that the configuration reflects the correct dependencies and settings as described.

## Intent

Resource "aws_s3_bucket"
has one "bucket"

Resource "aws_s3_bucket_acl" 
has one "bucket"
has one "acl" set to "private"

Resource "aws_s3_bucket"
has one "bucket"

Resource "aws_s3_bucket_acl"
has one "bucket"
has one "acl" set to "log-delivery-write"

Resource "aws_s3_bucket_logging"
has one "bucket"
has one "target_bucket"
has one "target_prefix"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "my-tf-example-bucket"
}

resource "aws_s3_bucket_acl" "example" {
  bucket = aws_s3_bucket.example.id
  acl    = "private"
}

resource "aws_s3_bucket" "log_bucket" {
  bucket = "my-tf-log-bucket"
}

resource "aws_s3_bucket_acl" "log_bucket_acl" {
  bucket = aws_s3_bucket.log_bucket.id
  acl    = "log-delivery-write"
}

resource "aws_s3_bucket_logging" "example" {
  bucket = aws_s3_bucket.example.id

  target_bucket = aws_s3_bucket.log_bucket.id
  target_prefix = "log/"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_s3_bucket_example = false
default has_aws_s3_bucket_acl_example = false
default has_aws_s3_bucket_log = false
default has_aws_s3_bucket_acl_log = false
default has_aws_s3_bucket_logging_example = false

has_aws_s3_bucket_example if {
    bucket := input.planned_values.root_module.resources[_]
    bucket.type == "aws_s3_bucket"
    bucket.values.bucket == "my-tf-example-bucket"
}

has_aws_s3_bucket_acl_example if {
    acl := input.planned_values.root_module.resources[_]
    acl.type == "aws_s3_bucket_acl"
    acl.values.acl == "private"
}

has_aws_s3_bucket_log if {
    bucket := input.planned_values.root_module.resources[_]
    bucket.type == "aws_s3_bucket"
    bucket.values.bucket == "my-tf-log-bucket"
}

has_aws_s3_bucket_acl_log if {
    acl := input.planned_values.root_module.resources[_]
    acl.type == "aws_s3_bucket_acl"
    acl.values.acl == "log-delivery-write"
}

has_aws_s3_bucket_logging_example if {
    logging := input.planned_values.root_module.resources[_]
    logging.type == "aws_s3_bucket_logging"
    logging.values.target_prefix == "log/"
}

valid_configuration if {
    has_aws_s3_bucket_example
    has_aws_s3_bucket_acl_example
    has_aws_s3_bucket_log
    has_aws_s3_bucket_acl_log
    has_aws_s3_bucket_logging_example
}

main if {
    valid_configuration
}
# Task 123


Craft a Terraform configuration for creating an AWS S3 bucket object. Define an S3 bucket object (with value "object") with specific attributes including the bucket name (with value "your_bucket_name"), object key (with value "new_object_key"), and the path to the source file (with value "path/to/file"). Do not use `filemd5()` or any file-reading functions.

## Intent

Resource "aws_s3_bucket_object"
has one "bucket"
has one "key"
has one "source"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket_object" "object" {
  bucket = "your_bucket_name"
  key    = "new_object_key"
  source = "path/to/file"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_s3_bucket_object = false

has_aws_s3_bucket_object if {
    object := input.planned_values.root_module.resources[_]
    object.type == "aws_s3_bucket_object"
    object.name == "object"
    object.values.bucket == "your_bucket_name"
    object.values.key == "new_object_key"
    object.values.source == "path/to/file"
}

valid_configuration if {
    has_aws_s3_bucket_object
}

main if {
    valid_configuration
}
# Task 124


Generate a Terraform configuration for creating an AWS S3 bucket and setting its ownership controls. Define a resource for an S3 bucket named "example". Follow this by configuring ownership controls for this bucket, referencing its ID. Within the ownership controls, set a rule to specify the object ownership as 'BucketOwnerPreferred'. Ensure that the resources are properly linked using references, and the configuration is clearly laid out to reflect these settings.

## Intent

Resource "aws_s3_bucket" 
has one "bucket"

Resource "aws_s3_bucket_ownership_controls"
has one "bucket"
within the "rule", it specifies:
"object_ownership"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "example"
}

resource "aws_s3_bucket_ownership_controls" "example" {
  bucket = aws_s3_bucket.example.id

  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_s3_bucket_example = false
default has_aws_s3_bucket_ownership_controls_example = false

has_aws_s3_bucket_example if {
    bucket := input.planned_values.root_module.resources[_]
    bucket.type == "aws_s3_bucket"
    bucket.values.bucket == "example"
}

has_aws_s3_bucket_ownership_controls_example if {
    controls := input.planned_values.root_module.resources[_]
    controls.type == "aws_s3_bucket_ownership_controls"
    controls.values.rule[_].object_ownership == "BucketOwnerPreferred"
}

valid_configuration if {
    has_aws_s3_bucket_example
    has_aws_s3_bucket_ownership_controls_example
}

main if {
    valid_configuration
}