iac-eval-v2/iac-eval-v2 huggingface dataset:
# Task 047


create an aws_lex_bot for booking a trip with all arguments filled

## Intent

Has one resource "aws_lex_bot" with all arguments initialized and at least one "aws_lex_intent" resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region  = "us-east-1"
}

resource "aws_lex_intent" "BookTrip" {
  description    = "Book a trip"
  name           = "BookTrip"

  sample_utterances = [
    "I want to book a trip",
    "I would like to book a trip",
  ]

  fulfillment_activity {
    type = "ReturnIntent"
  }
}

resource "aws_lex_bot" "BookTripBot" {
  description                   = "Bot for booking trips"
  idle_session_ttl_in_seconds   = 600
  locale                        = "en-US"
  name                          = "BookTripBot"
  process_behavior              = "BUILD"
  voice_id                      = "Salli"
  detect_sentiment = false
  enable_model_improvements = true
  nlu_intent_confidence_threshold = 0
  child_directed                = false

  abort_statement {
    message {
      content      = "Sorry, I cannot assist you to book the trip right now."
      content_type = "PlainText"
    }
  }
  
  clarification_prompt {
    max_attempts = 3

    message {
      content      = "I'm sorry, I didn't understand. Could you please repeat that?"
      content_type = "PlainText"
    }
  }

  intent {
    intent_name    = aws_lex_intent.BookTrip.name
    intent_version = aws_lex_intent.BookTrip.version
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_valid_resources = false

# Rule for multiple aws_lex_intent resources
has_valid_lex_intents if {
    count([intent | intent := input.planned_values.root_module.resources[_]; intent.type == "aws_lex_intent"; intent.values.name; intent.values.fulfillment_activity])
}

# Rule for aws_lex_bot resource with specific arguments
has_valid_lex_bot_instance if {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lex_bot"
    is_boolean(resource.values.child_directed)
    resource.values.clarification_prompt
    resource.values.abort_statement
    resource.values.name
    is_boolean(resource.values.create_version)
    resource.values.description
    is_boolean(resource.values.detect_sentiment)
    resource.values.idle_session_ttl_in_seconds
    resource.values.process_behavior
    resource.values.voice_id
    resource.values.locale
    is_boolean(resource.values.enable_model_improvements)
    resource.values.nlu_intent_confidence_threshold
}

# Combined rule to ensure all conditions are met
has_valid_resources if {
    has_valid_lex_intents
    has_valid_lex_bot_instance
}

main if {
    has_valid_lex_intents
    has_valid_lex_bot_instance
    has_valid_resources
}
# Task 049


create an aws_lex_bot for ordering pizzas that is meant for kids

## Intent

Has one resource "aws_lex_bot" with "child_directed" = true and at least one "aws_lex_intent" resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region  = "us-east-1"
}


resource "aws_lex_bot" "KidsPizzaOrderBot" {
  child_directed = true
  name           = "KidsPizzaOrderBot"
  process_behavior = "BUILD"
  idle_session_ttl_in_seconds = 300
  locale = "en-US"
  voice_id = "Salli"

  abort_statement {
    message {
      content      = "I'm sorry, I can't assist further on this."
      content_type = "PlainText"
    }
  }

  clarification_prompt {
    max_attempts = 1
    message {
      content      = "I'm sorry, could you please repeat that?"
      content_type = "PlainText"
    }
  }

  intent {
    intent_name    = aws_lex_intent.PizzaOrder.name
    intent_version = aws_lex_intent.PizzaOrder.version
  }

  intent {
    intent_name    = aws_lex_intent.CancelOrder.name
    intent_version = aws_lex_intent.CancelOrder.version
  }

  intent {
    intent_name    = aws_lex_intent.Appreciation.name
    intent_version = aws_lex_intent.Appreciation.version
  }
}

resource "aws_lex_intent" "PizzaOrder" {
  name = "PizzaOrder"
  description = "Intent for ordering pizza"

  sample_utterances = [
    "I would like to order a pizza",
  ]

  fulfillment_activity {
    type = "ReturnIntent"
  }
}

resource "aws_lex_intent" "CancelOrder" {
  name = "CancelOrder"
  description = "Intent for canceling pizza order"

  sample_utterances = [
    "I would like to cancel my order",
  ]

  fulfillment_activity {
    type = "ReturnIntent"
  }
}

resource "aws_lex_intent" "Appreciation" {
  name = "Appreciation"
  description = "Intent for appreciating the service"

  sample_utterances = [
    "I appreciate your service",
  ]

  fulfillment_activity {
    type = "ReturnIntent"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_valid_resources = false

# Rule for multiple aws_lex_intent resources
has_valid_lex_intents if {
    count([intent | intent := input.planned_values.root_module.resources[_]; intent.type == "aws_lex_intent"; intent.values.name; intent.values.fulfillment_activity])
}

# Rule for aws_lex_bot resource with specific arguments
has_valid_lex_bot_instance if {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lex_bot"
    resource.values.child_directed == true
    resource.values.clarification_prompt
    resource.values.abort_statement
    resource.values.name
}

# Combined rule to ensure all conditions are met
has_valid_resources if {
    has_valid_lex_intents
    has_valid_lex_bot_instance
}

main if {
    has_valid_lex_intents
    has_valid_lex_bot_instance
    has_valid_resources
}
# Task 057


Generate a basic Amazon Kinesis stream

## Intent

Has one "aws_kinesis_stream" resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-west-2"
}

resource "aws_kinesis_stream" "test_stream" {
  name             = "drow1"
  shard_count      = 1
  retention_period = 48

  shard_level_metrics = [
    "IncomingBytes",
    "OutgoingBytes",
  ]

  stream_mode_details {
    stream_mode = "PROVISIONED"
  }

  tags = {
    Environment = "test"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_valid_resources = false

has_valid_kinesis_stream if {
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesis_stream"
    resource.values.name
}

has_valid_resources if {
	has_valid_kinesis_stream
}

main if {
    has_valid_kinesis_stream
    has_valid_resources
}
# Task 069


Generate a basic Kinesis Video Stream resource

## Intent

Has one "aws_kinesis_video_stream" resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_kinesis_video_stream" "default" {
  name                    = "terraform-kinesis-video-stream"
  data_retention_in_hours = 1
  device_name             = "kinesis-video-device-name"
  media_type              = "video/h264"

  tags = {
    Name = "terraform-kinesis-video-stream"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_valid_resources = false

has_valid_kinesis_video_stream if {
	some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesis_video_stream"
    resource.values.name
}

has_valid_resources if {
	has_valid_kinesis_video_stream
}

main if {
    has_valid_kinesis_video_stream
    has_valid_resources
}
# Task 072


Generate a basic Amazon Kinesis Analytics Application

## Intent

Has one "aws_kinesis_analytics_application" resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-west-2"
}

resource "aws_kinesis_analytics_application" "test_application" {
  name = "kinesis-analytics-application-test"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_valid_resources = false

has_valid_kinesis_analytics_application if {
        some i
        resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesis_analytics_application"
    resource.values.name
}

has_valid_resources if {
    has_valid_kinesis_analytics_application
}

main if {
    has_valid_kinesis_analytics_application
    has_valid_resources
}
# Task 079


Set up an aws_route_53 zone named "example53.com"

## Intent

Has one "aws_route53_zone" resource
    with "name" set to "example53.com"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_route53_zone" "primary" {
  name = "example53.com"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default is_configuration_valid = false

default is_valid_r53_zone = false


# Validate aws_route53_zone resource
is_valid_r53_zone if {
	some i
	resource := input.resource_changes[i]
    resource.type == "aws_route53_zone"
    resource.change.after.name == "example53.com"
}


# Combine all checks into a final rule
is_configuration_valid if {
    is_valid_r53_zone
}

main if {
    is_valid_r53_zone
    is_configuration_valid
}
# Task 092


Create a Terraform script for an AWS EKS access entry with name "example". Define a resource to grant access to an EKS cluster using the cluster's name and a principal's ARN. Include assigning specific Kubernetes groups and set the access type to 'STANDARD'.

## Intent

has one "aws_eks_access_entry" resource
with one "cluster_name"
with one "principal_arn"
with one "kubernetes_groups"
with one "type"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "private-us-east-1a" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_iam_role" "example" {
  name = "eks-cluster-1"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example.name
}

resource "aws_eks_cluster" "example" {
  name     = "test"
  version  = "test-version"
  role_arn = aws_iam_role.example.arn

  vpc_config {
    subnet_ids = [
      aws_subnet.private-us-east-1a.id,
    ]
  }
}

resource "aws_eks_access_entry" "example" {
  cluster_name      = aws_eks_cluster.example.name
  principal_arn     = aws_iam_role.example.arn
  kubernetes_groups = ["group-1", "group-2"]
  type              = "STANDARD"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_eks_access_entry_example = false

has_aws_eks_access_entry_example if {
    entry := input.planned_values.root_module.resources[_]
    entry.type == "aws_eks_access_entry"
    entry.name == "example"
    entry.values.kubernetes_groups == ["group-1", "group-2"]
    entry.values.type == "STANDARD"
}

main if {
    has_aws_eks_access_entry_example
}
# Task 093


Create a Terraform script to associate an access policy with name "example", with an AWS EKS cluster. Define a resource linking the cluster's name to the EKS access policy ARN "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy" and a principal's ARN. Include settings for an access scope limited to a specific namespace.

## Intent

has one "aws_eks_access_policy_association" resource
with one "cluster_name"
with one "policy_arn"
with one "principal_arn"
with one "access_scope"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "private-us-east-1a" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_iam_role" "example" {
  name = "eks-cluster-1"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example.name
}

resource "aws_eks_cluster" "example" {
  name     = "test"
  version  = "test-version"
  role_arn = aws_iam_role.example.arn

  vpc_config {
    subnet_ids = [
      aws_subnet.private-us-east-1a.id,
    ]
  }
}

resource "aws_iam_user" "example" {
  name = "eks-test"
}

resource "aws_eks_access_policy_association" "example" {
  cluster_name  = aws_eks_cluster.example.name
  policy_arn    = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy"
  principal_arn = aws_iam_user.example.arn

  access_scope {
    type       = "namespace"
    namespaces = ["example-namespace"]
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_eks_access_policy_association_example = false

has_aws_eks_access_policy_association_example if {
    policy_assoc := input.planned_values.root_module.resources[_]
    policy_assoc.type == "aws_eks_access_policy_association"
    policy_assoc.name == "example"
    policy_assoc.values.policy_arn == "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy"
    policy_assoc.values.access_scope[_].type == "namespace"
    policy_assoc.values.access_scope[_].namespaces == ["example-namespace"]
}

main if {
    has_aws_eks_access_policy_association_example
}
# Task 094


Generate a Terraform script to add an addon with name "example", to an AWS EKS cluster. Define a resource that specifies the cluster's name and sets the addon name to 'vpc-cni'.

## Intent

has one "aws_eks_addon" resource
with one "cluster_name"
with one "addon_name"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "private-us-east-1a" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_iam_role" "example" {
  name = "eks-cluster-1"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example.name
}

resource "aws_eks_cluster" "example" {
  name     = "test"
  version  = "test-version"
  role_arn = aws_iam_role.example.arn

  vpc_config {
    subnet_ids = [
      aws_subnet.private-us-east-1a.id,
    ]
  }
}

resource "aws_eks_addon" "example" {
  cluster_name = aws_eks_cluster.example.name
  addon_name   = "vpc-cni"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_eks_addon_example = false

has_aws_eks_addon_example if {
    addon := input.planned_values.root_module.resources[_]
    addon.type == "aws_eks_addon"
    addon.name == "example"
    addon.values.addon_name == "vpc-cni"
}

main if {
    has_aws_eks_addon_example
}
# Task 097


Create a Terraform script for an AWS IAM role designed for EKS Fargate profiles. Define a role with a specific name (with the name attribute set to "eks-fargate-profile-example") and an assume role policy that allows actions from 'eks-fargate-pods.amazonaws.com'. Also, attach a predefined Amazon EKS Fargate Pod Execution Role Policy to this role.

## Intent

has one "aws_iam_role" resource
with one "name"
with one "assume_role_policy"

has one "aws_iam_role_policy_attachment" resource
with one "policy_arn"
with one "role"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_role" "example" {
  name = "eks-fargate-profile-example"

  assume_role_policy = jsonencode({
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "eks-fargate-pods.amazonaws.com"
      }
    }]
    Version = "2012-10-17"
  })
}

resource "aws_iam_role_policy_attachment" "example-AmazonEKSFargatePodExecutionRolePolicy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
  role       = aws_iam_role.example.name
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_iam_role_example = false
default has_aws_iam_role_policy_attachment_example = false

has_aws_iam_role_example if {
    role := input.planned_values.root_module.resources[_]
    role.type == "aws_iam_role"
    role.values.name == "eks-fargate-profile-example"
    assume_policy := json.unmarshal(role.values.assume_role_policy)
    assume_policy.Statement[0].Action == "sts:AssumeRole"
    assume_policy.Statement[0].Effect == "Allow"
    assume_policy.Statement[0].Principal.Service == "eks-fargate-pods.amazonaws.com"
    assume_policy.Version == "2012-10-17"
}

has_aws_iam_role_policy_attachment_example if {
    attachment := input.planned_values.root_module.resources[_]
    attachment.type == "aws_iam_role_policy_attachment"
    attachment.values.policy_arn == "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
}

valid_configuration if {
    has_aws_iam_role_example
    has_aws_iam_role_policy_attachment_example
}

main if {
    valid_configuration
}
# Task 098


Generate a Terraform script to configure an OIDC identity provider for an AWS EKS cluster (where the cluster has it's name attribute set to "example"). Define a resource that links to the cluster by name and sets up OIDC with specific parameters including client ID, identity provider config name, and issuer URL.

## Intent

has one "aws_eks_identity_provider_config" resource
with one "cluster_name"
with one "oidc" block containing:
one "client_id"
one "identity_provider_config_name"
one "issuer_url"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example1" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_subnet" "example2" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.2.0/24"
}

resource "aws_iam_role" "example" {
  name = "eks-cluster-1"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example.name
}

resource "aws_eks_cluster" "example" {
  name     = "example"
  role_arn = aws_iam_role.example.arn

  vpc_config {
    subnet_ids = [aws_subnet.example1.id, aws_subnet.example2.id]
  }
}

resource "aws_eks_identity_provider_config" "example" {
  cluster_name = aws_eks_cluster.example.name

  oidc {
    client_id                     = "your client_id"
    identity_provider_config_name = "example"
    issuer_url                    = "https://www.sampleurl.com"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_aws_eks_identity_provider_config_example = false

has_aws_eks_identity_provider_config_example if {
    identity_provider_config := input.planned_values.root_module.resources[_]
    identity_provider_config.type == "aws_eks_identity_provider_config"
    identity_provider_config.values.oidc[_].client_id != null
    identity_provider_config.values.oidc[_].identity_provider_config_name != null
    identity_provider_config.values.oidc[_].issuer_url != null
}

main if {
    has_aws_eks_identity_provider_config_example
}
# Task 108


Create a bucket "sample". Implement versioning resource for the AWS S3 bucket named 'sample' with the versioning status set to 'Enabled' and specify the expected_bucket_owner as '123456789012' to ensure ownership consistency.

## Intent

has one aws_s3_bucket resource
with bucket

has one "aws_s3_bucket_versioning" resource
     with bucket
     with versionaning_configuration
          with status

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "sample" {
  bucket = "sample"
}

resource "aws_s3_bucket_versioning" "sample" {
  bucket = "sample"
  versioning_configuration {
    status = "Enabled"
  }
  expected_bucket_owner = "123456789012"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default has_s3_bucket_versioning = false

default has_s3_bucket = false

default valid_configuration = false

has_s3_bucket if {
    resource := input.resource_changes[_]
    resource.type == "aws_s3_bucket"
    resource.name == "sample"
}

has_s3_bucket_versioning if {
    versioning := input.resource_changes[_]
    versioning.type == "aws_s3_bucket_versioning"
    versioning.change.after.expected_bucket_owner == "123456789012"
    versioning.change.after.versioning_configuration[_].status == "Enabled"
}

valid_configuration if {
    has_s3_bucket
    has_s3_bucket_versioning
}

main if {
    valid_configuration
}