iac-eval-v2/iac-eval-v2 huggingface dataset:
# Task 178


Create a aws_sagemaker_image

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_iam_role" "example" {
  name               = "example"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.example.json
}

data "aws_iam_policy_document" "example" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

resource "aws_sagemaker_image" "example" {
  image_name = "example"
  role_arn   = aws_iam_role.example.arn
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_iam_role_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_sagemaker_image_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_image"
}


# Aggregate all checks
allow if {
    aws_sagemaker_image_valid(input.resource_changes)
    aws_iam_role_valid(input.resource_changes)
}

main if {
    allow
}
# Task 179


Create an aws_sagemaker_model running the kmeans image.

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-west-2"
}

resource "aws_sagemaker_model" "example" {
  name               = "my-model"
  execution_role_arn = aws_iam_role.example.arn

  primary_container {
    image = data.aws_sagemaker_prebuilt_ecr_image.test.registry_path
  }
}

resource "aws_iam_role" "example" {
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

data "aws_sagemaker_prebuilt_ecr_image" "test" {
  repository_name = "kmeans"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_iam_role_valid(resources) if {
	some resource in resources
	resource.type == "aws_iam_role"
}

aws_sagemaker_model_valid(resources) if {
	some resource in resources
	resource.type == "aws_sagemaker_model"
	contains(resource.change.after.primary_container[0].image, "kmeans")
}

# Aggregate all checks
allow if {
	aws_iam_role_valid(input.resource_changes)
	aws_sagemaker_model_valid(input.resource_changes)
}

main if {
    allow
}
# Task 180


Create an aws_sagemaker_notebook_instance on an ml.t2.medium

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_sagemaker_notebook_instance" "ni" {
  name          = "my-notebook-instance"
  role_arn      = aws_iam_role.example.arn
  instance_type = "ml.t2.medium"
}

resource "aws_iam_role" "example" {
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

data "aws_sagemaker_prebuilt_ecr_image" "test" {
  repository_name = "kmeans"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_iam_role_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_sagemaker_notebook_instance_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_notebook_instance"
    resource.change.after.instance_type == "ml.t2.medium"
}

# Aggregate all checks
allow if {
    aws_iam_role_valid(input.resource_changes)
    aws_sagemaker_notebook_instance_valid(input.resource_changes)
}

main if {
    allow
}
# Task 181


Create an aws_sagemaker_notebook instance from "https://github.com/hashicorp/terraform-provider-aws.git"

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_sagemaker_code_repository" "example" {
  code_repository_name = "my-notebook-instance-code-repo"

  git_config {
    repository_url = "https://github.com/hashicorp/terraform-provider-aws.git"
  }
}

resource "aws_sagemaker_notebook_instance" "ni" {
  name                    = "my-notebook-instance"
  role_arn                = aws_iam_role.example.arn
  instance_type           = "ml.t2.medium"
  default_code_repository = aws_sagemaker_code_repository.example.code_repository_name
}

resource "aws_iam_role" "example" {
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

data "aws_sagemaker_prebuilt_ecr_image" "test" {
  repository_name = "kmeans"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_iam_role_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_sagemaker_code_repository_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_code_repository"
    resource.change.after.git_config[0].repository_url ==  "https://github.com/hashicorp/terraform-provider-aws.git"
}

aws_sagemaker_notebook_instance_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_notebook_instance"
    resource.change.after.default_code_repository != null
}

# Aggregate all checks
allow if {
    aws_iam_role_valid(input.resource_changes)
    aws_sagemaker_code_repository_valid(input.resource_changes)
    aws_sagemaker_notebook_instance_valid(input.resource_changes)
}

main if {
    allow
}
# Task 182


Create a SageMaker Pipeline resource.

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_sagemaker_pipeline" "example" {
  pipeline_name         = "example"
  pipeline_display_name = "example"
  role_arn              = aws_iam_role.example.arn

  pipeline_definition = jsonencode({
    Version = "2020-12-01"
    Steps = [{
      Name = "Test"
      Type = "Fail"
      Arguments = {
        ErrorMessage = "test"
      }
    }]
  })
}

resource "aws_iam_role" "example" {
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

data "aws_sagemaker_prebuilt_ecr_image" "test" {
  repository_name = "kmeans"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_iam_role_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_sagemaker_pipeline_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_pipeline"
}

# Aggregate all checks
allow if {
    aws_iam_role_valid(input.resource_changes)
    aws_sagemaker_pipeline_valid(input.resource_changes)
}

main if {
    allow
}
# Task 183


Create a SageMaker Human Task UI resource with inline ui_template content set to exactly:
```
<h1>
    TEST
</h1>
```
Do not use `file()` to read from an external file — provide the content inline.

## Intent

Has one "aws_sagemaker_human_task_ui" resource with ui_template content matching the specified HTML.

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_sagemaker_human_task_ui" "example" {
  human_task_ui_name = "example"

  ui_template {
    content = "<h1>\n    TEST\n</h1>"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_sagemaker_human_task_ui_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_human_task_ui"
    resource.change.after.ui_template[0].content == "\u003ch1\u003e\n    TEST\n\u003c/h1\u003e"

}

# Aggregate all checks
allow if {
    aws_sagemaker_human_task_ui_valid(input.resource_changes)
}

main if {
    allow
}
# Task 184


Create a SageMaker endpoint cofiguration for a sagemaker_model

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_sagemaker_model" "example" {
  name               = "my-model"
  execution_role_arn = aws_iam_role.example.arn

  primary_container {
    image = data.aws_sagemaker_prebuilt_ecr_image.test.registry_path
  }
}

resource "aws_iam_role" "example" {
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

data "aws_sagemaker_prebuilt_ecr_image" "test" {
  repository_name = "kmeans"
}

resource "aws_sagemaker_endpoint_configuration" "ec" {
  name = "my-endpoint-config"

  production_variants {
    variant_name           = "variant-1"
    model_name             = aws_sagemaker_model.example.name
    initial_instance_count = 1
    instance_type          = "ml.t2.medium"
  }

}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_iam_role_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_sagemaker_model_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_model"
}

aws_sagemaker_endpoint_configuration_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_endpoint_configuration"
}

# Aggregate all checks
allow if {
    aws_iam_role_valid(input.resource_changes)
    aws_sagemaker_model_valid(input.resource_changes)
    aws_sagemaker_endpoint_configuration_valid(input.resource_changes)
}

main if {
    allow
}
# Task 185


Create a SageMaker endpoint

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_sagemaker_model" "example" {
  name               = "my-model"
  execution_role_arn = aws_iam_role.example.arn

  primary_container {
    image = data.aws_sagemaker_prebuilt_ecr_image.test.registry_path
  }
}

resource "aws_iam_role" "example" {
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

data "aws_sagemaker_prebuilt_ecr_image" "test" {
  repository_name = "kmeans"
}

resource "aws_sagemaker_endpoint_configuration" "ec" {
  name = "my-endpoint-config"

  production_variants {
    variant_name           = "variant-1"
    model_name             = aws_sagemaker_model.example.name
    initial_instance_count = 1
    instance_type          = "ml.t2.medium"
  }

}

resource "aws_sagemaker_endpoint" "e" {
  name                 = "my-endpoint"
  endpoint_config_name = aws_sagemaker_endpoint_configuration.ec.name

}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_iam_role_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_sagemaker_model_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_model"
}

aws_sagemaker_endpoint_configuration_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_endpoint_configuration"
}

aws_sagemaker_endpoint_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_endpoint"
}

# Aggregate all checks
allow if {
    aws_iam_role_valid(input.resource_changes)
    aws_sagemaker_model_valid(input.resource_changes)
    aws_sagemaker_endpoint_configuration_valid(input.resource_changes)
    aws_sagemaker_endpoint_valid(input.resource_changes)
}

main if {
    allow
}
# Task 186


Create an AWS Lambda function. The function should be triggered by a nodejs18 runtime,use a "lambda.js" as the source code and a "index.js" as the handler. Please declare all necessary resources.

## Intent

Needs to have a defined IAM role. Data for a .zip file, with source file = lambda.js, function name can be anything. For the aws_lambda_function use the defined zip, function name, set handler to anything, and runtime to "nodejs.18x"

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "iam_for_lambda" {
  name               = "iam_for_lambda"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "archive_file" "lambda" {
  type        = "zip"
  output_path = "${path.module}/lambda_function_payload.zip"

  source {
    content  = "exports.handler = async (event) => ({ statusCode: 200, body: 'OK' });"
    filename = "lambda.js"
  }
}

resource "aws_lambda_function" "test_lambda" {
  filename      = "lambda_function_payload.zip"
  function_name = "lambda_function_name"
  role          = aws_iam_role.iam_for_lambda.arn
  handler       = "index.test"

  runtime = "nodejs18.x"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_iam_role_for_lambda_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_lambda_function_valid(resources) if {
    some resource in resources
    resource.type == "aws_lambda_function"
    resource.change.after.runtime == "nodejs18.x"
    resource.change.after.handler == "index.test"
    resource.change.after.filename == "lambda_function_payload.zip"
}

allow if {
    aws_iam_role_for_lambda_valid(input.resource_changes)
    aws_lambda_function_valid(input.resource_changes)
}

main if {
    allow
}
# Task 187


Create the latest Amazon Linux 2 AMI with cpu count= 2 and cores per threads per core= 2

## Intent

create aws_ami resource with cpu_count = 2 and cores_per_thread=2

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  # Configure your AWS provider settings here
  region = "us-east-1"  # Update with your desired AWS region
}

data "aws_ami" "latest_amazon_linux_2" {
  most_recent = true

  owners = ["amazon"]

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }

  filter {
    name   = "root-device-type"
    values = ["ebs"]
  }
}

resource "aws_instance" "example_instance" {
  ami           = data.aws_ami.latest_amazon_linux_2.id
  instance_type = "t3.2xlarge"

  cpu_options {
    core_count       = 2
    threads_per_core = 2
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

allow if {
    check_aws_instance(input.resource_changes)
}

check_aws_instance(resources) if {
    some resource in resources
    resource.type == "aws_instance"
    check_cpu_options(resource)
}

check_cpu_options(aws_instance) if {
	aws_instance.change.after.cpu_options[0].core_count == 2
	aws_instance.change.after.cpu_options[0].threads_per_core == 2
}

main if {
    allow
}
# Task 193


Create 3 EC2 instances within an EC2 placement group usign clustering.

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

# Create a Virtual Private Cloud (VPC)
resource "aws_vpc" "my_vpc" {
  cidr_block = "10.0.0.0/16"
}

data "aws_availability_zones" "azs" {
    state = "available"
}

# Create Public Subnet
resource "aws_subnet" "public_subnet" {
  vpc_id                  = aws_vpc.my_vpc.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = data.aws_availability_zones.azs.names[0]
  map_public_ip_on_launch = true
}

# Create Private Subnet
resource "aws_subnet" "private_subnet" {
  vpc_id            = aws_vpc.my_vpc.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = data.aws_availability_zones.azs.names[1]
}

# Create EC2 Placement Group
resource "aws_placement_group" "my_placement_group" {
  name     = "my-placement-group"
  strategy = "cluster"
}

# Create Security Group for EC2 instances
resource "aws_security_group" "ec2_sg" {
  vpc_id = aws_vpc.my_vpc.id
  name   = "ec2_sg"
}

data "aws_ami" "amzn2" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["*ubuntu-noble-24.04-amd64-server-*"]
  }
}

# Create EC2 instances in the Placement Group in the Private Subnet
resource "aws_instance" "ec2_instance" {
  count           = 3
  ami             = data.aws_ami.amzn2.id
  instance_type   = "m5.large"
  subnet_id       = aws_subnet.private_subnet.id
  security_groups = [aws_security_group.ec2_sg.id]
  placement_group = aws_placement_group.my_placement_group.name
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

placement_group_exists if {
    some i
    input.resource_changes[i].type == "aws_placement_group"
    input.resource_changes[i].change.after.strategy == "cluster"
}

aws_instances contains resource if {
    resource := input.resource_changes[_]
    resource.type == "aws_instance"
    resource.change.after.placement_group != null
    resource.change.after.placement_group != ""
}

allow if {
    placement_group_exists
    count(aws_instances) == 3
}

main if {
    allow
}
# Task 194


Provide a resource to reduce the number of database calls.

## Intent

requires cluster id, engine=memcached, node_type, num_cache_nodes, parameter_group_name

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_elasticache_cluster" "example" {
  cluster_id           = "cluster-example"
  engine               = "memcached"
  node_type            = "cache.m4.large"
  num_cache_nodes      = 2
  parameter_group_name = "default.memcached1.4"
  port                 = 11211
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_elasticache_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_cluster"
    resource.change.after.engine == "memcached"
}

# Aggregate all checks
allow if {
    aws_elasticache_cluster_valid(input.resource_changes)
}

main if {
    allow
}
# Task 195


authenticate a elasticache user with redis

## Intent

requires access string, engine = REDIS, user id and user name

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
  engine        = "REDIS"
  passwords     = ["password123456789"]
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_elasticache_user_valid(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.engine == "REDIS"
}

# Aggregate all checks
allow if {
    aws_elasticache_user_valid(input.resource_changes)
}

main if {
    allow
}
# Task 196


authenticate a elasticache user with iam

## Intent

requires access string, engine = REDIS, user id and user name, authentication_mode {type = "iam"}

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~* +@all"
  engine        = "REDIS"

  authentication_mode {
    type = "iam"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_elasticache_user_valid(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.authentication_mode[_].type == "iam"
}

# Aggregate all checks
allow if {
    aws_elasticache_user_valid(input.resource_changes)
}

main if {
    allow
}
# Task 197


authenticate a elasticache user with passwords

## Intent

requires access string, engine = REDIS, user id and user name, authentication_mode {type= "password", passwords = ["password1", "password2"]}

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~* +@all"
  engine        = "REDIS"

  authentication_mode {
    type      = "password"
    passwords = ["password1", "password2"]
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_elasticache_user_valid(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.authentication_mode[_].type == "password"
}

# Aggregate all checks
allow if {
    aws_elasticache_user_valid(input.resource_changes)
}

main if {
    allow
}
# Task 198


Provides an ElastiCache user group resource with 3 users

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "default"
  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
  engine        = "REDIS"
  passwords     = ["password123456789"]
}

resource "aws_elasticache_user_group" "test" {
  engine        = "REDIS"
  user_group_id = "userGroupId"
  user_ids      = [aws_elasticache_user.test.user_id]
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_elasticache_user_group_exists(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user_group"
    resource.change.actions[_] == "create"
}

aws_elasticache_user_exists(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.actions[_] == "create"
}

allow if {
    aws_elasticache_user_group_exists(input.resource_changes)
    aws_elasticache_user_exists(input.resource_changes)
}

main if {
    allow
}