iac-eval-v2/iac-eval-v2 huggingface dataset:
# Task 162


Generate a Terraform HCL code snippet to define an AWS CloudWatch metric alarm named 'foobar' that monitors the 'CPUUtilization' metric of AWS EC2 instances. The alarm should trigger when the average CPU utilization is greater than or equal to 80% for two consecutive 2-minute periods. Ensure that no actions are taken when there's insufficient data.

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_cloudwatch_metric_alarm" "foobar" {
  alarm_name                = "terraform-test-foobar5"
  comparison_operator       = "GreaterThanOrEqualToThreshold"
  evaluation_periods        = 2
  metric_name               = "CPUUtilization"
  namespace                 = "AWS/EC2"
  period                    = 120
  statistic                 = "Average"
  threshold                 = 80
  alarm_description         = "This metric monitors ec2 cpu utilization"
  insufficient_data_actions = []
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS CloudWatch Composite Alarm is being created
aws_cloudwatch_composite_alarm_valid(resources) if {
    some resource in resources
    resource.type == "aws_cloudwatch_metric_alarm"
    resource.change.after.comparison_operator == "GreaterThanOrEqualToThreshold"
    resource.change.after.threshold == 80
    resource.change.after.evaluation_periods == 2
}

# Aggregate all checks
allow if {
    aws_cloudwatch_composite_alarm_valid(input.resource_changes)
}

main if {
    allow
}
# Task 163


Create a DynamoDB Contributor Insights resource for a specific table with custom settings

## Intent

Create a DynamoDB table and enable contributor insights

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_dynamodb_contributor_insights" "test" {
  table_name = "ExampleTableName"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS DynamoDB Contributor Insights is being created for a specific table
aws_dynamodb_contributor_insights_valid(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_contributor_insights"
}

# Aggregate all checks
allow if {
    aws_dynamodb_contributor_insights_valid(input.resource_changes)
}

main if {
    allow
}
# Task 164


Create a DynamoDB Table in us-east-1, us-west-1 and us-west-2

## Intent

Create a DynamoDB Global Table v1(requires a name and at least one replica (regions))

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region  = "us-east-1"
}

resource "aws_dynamodb_table" "base_table" {
  billing_mode     = "PAY_PER_REQUEST"
  hash_key         = "myAttribute"
  name             = "myTable"
  stream_enabled   = true
  stream_view_type = "NEW_AND_OLD_IMAGES"

  attribute {
    name = "myAttribute"
    type = "S"
  }

  replica {
    region_name = "us-west-1"
  }

  replica {
    region_name = "us-west-2"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_dynamodb_table_valid(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_table"
    resource.change.actions[_] == "create"
    resource.change.after.name == "myTable"
}

replicas_valid(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_table"
    resource.change.after.replica[_].region_name == "us-west-1"
    resource.change.after.replica[_].region_name == "us-west-2"
}

allow if {
    aws_dynamodb_table_valid(input.resource_changes)
    replicas_valid(input.resource_changes)
}

main if {
    allow
}
# Task 165


Create a Kinesis Streaming Destination for a specific DynamoDB table.

## Intent

create a stream_arn (name), dynamodb table(hash_key, name, attribute (name, type)), create the kineses streaming

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_dynamodb_table" "example" {
  name     = "orders"
  hash_key = "id"

  attribute {
    name = "id"
    type = "S"
  }
}

resource "aws_kinesis_stream" "example" {
  name        = "order_item_changes"
  shard_count = 1
}

resource "aws_dynamodb_kinesis_streaming_destination" "example" {
  stream_arn = aws_kinesis_stream.example.arn
  table_name = aws_dynamodb_table.example.name
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS DynamoDB Kinesis Streaming Destination is being created for a specific table
aws_dynamodb_kinesis_streaming_destination_valid(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_kinesis_streaming_destination"
}

# Aggregate all checks
allow if {
    aws_dynamodb_kinesis_streaming_destination_valid(input.resource_changes)
}

main if {
    allow
}
# Task 166


Create a DynamoDB table with custom read capacity = 20 and write capacity = 20.

## Intent

dynamodb table -> hash_key, name, attribute (name, type), read_capacity = 20, write_capacity = 20

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_dynamodb_table" "basic-dynamodb-table" {
  name           = "GameScores"
  billing_mode   = "PROVISIONED"
  read_capacity  = 20
  write_capacity = 20
  hash_key       = "UserId"
  range_key      = "GameTitle"

  attribute {
    name = "UserId"
    type = "S"
  }

  attribute {
    name = "GameTitle"
    type = "S"
  }

  attribute {
    name = "TopScore"
    type = "N"
  }

  ttl {
    attribute_name = "TimeToExist"
    enabled        = false
  }

  global_secondary_index {
    name               = "GameTitleIndex"
    hash_key           = "GameTitle"
    range_key          = "TopScore"
    write_capacity     = 10
    read_capacity      = 10
    projection_type    = "INCLUDE"
    non_key_attributes = ["UserId"]
  }

  tags = {
    Name        = "dynamodb-table-1"
    Environment = "production"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS DynamoDB table is being created with specific read and write capacity settings
aws_dynamodb_table_custom_capacity_valid(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_table"
    resource.change.after.read_capacity == 20
    resource.change.after.write_capacity == 20

}

# Aggregate all checks
allow if {
    aws_dynamodb_table_custom_capacity_valid(input.resource_changes)
}

main if {
    allow
}
# Task 167


Provide a DynamoDB table item resource using terraform

## Intent

dynamodb table -> hash_key, name, attribute (name, type), read_capacity = x, write_capacity = x, create a table_item using table name, hashkey, and json item object

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_dynamodb_table_item" "example" {
  table_name = aws_dynamodb_table.example.name
  hash_key   = aws_dynamodb_table.example.hash_key

  item = <<ITEM
{
  "exampleHashKey": {"S": "something"},
  "one": {"N": "11111"},
  "two": {"N": "22222"},
  "three": {"N": "33333"},
  "four": {"N": "44444"}
}
ITEM
}

resource "aws_dynamodb_table" "example" {
  name           = "example-name"
  read_capacity  = 10
  write_capacity = 10
  hash_key       = "exampleHashKey"

  attribute {
    name = "exampleHashKey"
    type = "S"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS DynamoDB table is being created with specific read and write capacity settings
aws_dynamodb_table_item_valid(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_table_item"

}

# Aggregate all checks
allow if {
    aws_dynamodb_table_item_valid(input.resource_changes)
}

main if {
    allow
}
# Task 168


Create a DynamoDB Global Table and create a replica of the table

## Intent

dynamodb table -> hash_key, name, attribute (name, type) -> create a repilca with the table arn

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  alias  = "alt"
  region = "us-east-2"
}

resource "aws_dynamodb_table" "example" {
  provider         = aws.alt
  name             = "TestTable"
  hash_key         = "BrodoBaggins"
  billing_mode     = "PAY_PER_REQUEST"
  stream_enabled   = true
  stream_view_type = "NEW_AND_OLD_IMAGES"

  attribute {
    name = "BrodoBaggins"
    type = "S"
  }

  lifecycle {
    ignore_changes = [replica]
  }
}

resource "aws_dynamodb_table_replica" "example" {
  provider         = aws.alt
  global_table_arn = aws_dynamodb_table.example.arn

  tags = {
    Name = "IZPAWS"
    Pozo = "Amargo"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dynamodb_table(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_table"
}

# Check if the AWS DynamoDB table replica is being created in us-east-2
aws_dynamodb_table_replica(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_table_replica"
}

# Aggregate all checks
allow if {
    aws_dynamodb_table(input.resource_changes)
    aws_dynamodb_table_replica(input.resource_changes)
}

main if {
    allow
}
# Task 169


Create a DAX cluster with node type = dax.r4.large and replication factor = 1.

## Intent

require a cluster name, iam_role_arn, node_type, replication factor

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_role" "example" {
  name = "test"

  assume_role_policy = jsonencode({
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "eks.amazonaws.com"
      }
    }]
    Version = "2012-10-17"
  })
}


resource "aws_dax_cluster" "bar" {
  cluster_name       = "cluster-example"
  iam_role_arn       = aws_iam_role.example.arn
  node_type          = "dax.r4.large"
  replication_factor = 1
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dax_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_dax_cluster"
    resource.change.after.node_type == "dax.r4.large"
    resource.change.after.replication_factor == 1
}

# Aggregate all checks
allow if {
    aws_dax_cluster_valid(input.resource_changes)
}

main if {
    allow
}
# Task 170


Create a custom DAX parameter group

## Intent

require name of the group, list of parameters (key, value) pairs

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_dax_parameter_group" "example" {
  name = "example"

  parameters {
    name  = "query-ttl-millis"
    value = "100000"
  }

  parameters {
    name  = "record-ttl-millis"
    value = "100000"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dax_parameter_group_valid(resources) if {
    some resource in resources
    resource.type == "aws_dax_parameter_group"
}

# Aggregate all checks
allow if {
    aws_dax_parameter_group_valid(input.resource_changes)
}

main if {
    allow
}
# Task 171


Create a custom DAX subnet group

## Intent

create subnets -> create subnet groups

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example1" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_subnet" "example2" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_dax_subnet_group" "example" {
  name       = "example"
  subnet_ids = [aws_subnet.example1.id, aws_subnet.example2.id]
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dax_subnet_group_valid(resources) if {
    some resource in resources
    resource.type == "aws_dax_subnet_group"
}

# Aggregate all checks
allow if {
    aws_dax_subnet_group_valid(input.resource_changes)
}

main if {
    allow
}
# Task 172


Configure on-demand capacity mode for a DynamoDB table.

## Intent

dynamodb table -> hash_key, name, attribute (name, type), billing mode pay per read

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_dynamodb_table" "basic-dynamodb-table" {
  name           = "example"
  billing_mode   = "PAY_PER_REQUEST"
  hash_key       = "UserId"

  attribute {
    name = "UserId"
    type = "S"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dynamodb_table_valid(resources) if {
    some resource in resources
    resource.type == "aws_dynamodb_table"
    resource.change.after.billing_mode == "PAY_PER_REQUEST"
}

# Aggregate all checks
allow if {
    aws_dynamodb_table_valid(input.resource_changes)
}

main if {
    allow
}
# Task 173


Create a SageMaker Domain resource.

## Intent

Has a sagemaker domain resources which requires a an iam role and a subnet

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example" {
  vpc_id     = aws_vpc.example.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_sagemaker_domain" "example" {
  domain_name = "example"
  auth_mode   = "IAM"
  vpc_id      = aws_vpc.example.id
  subnet_ids  = [aws_subnet.example.id]

  default_user_settings {
    execution_role = aws_iam_role.example.arn
  }
}

resource "aws_iam_role" "example" {
  name               = "example"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.example.json
}

data "aws_iam_policy_document" "example" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false


aws_sagemaker_domain_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_domain"
}

aws_iam_role_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_vpc_valid(resources) if {
    some resource in resources
    resource.type == "aws_vpc"
}

aws_subnet_valid(resources) if {
    some resource in resources
    resource.type == "aws_subnet"
}

# Aggregate all checks
allow if {
    aws_sagemaker_domain_valid(input.resource_changes)
    aws_iam_role_valid(input.resource_changes)
    aws_vpc_valid(input.resource_changes)
    aws_subnet_valid(input.resource_changes)
}

main if {
    allow
}
# Task 174


Create a SageMaker user profile resource

## Intent

Has a sagemaker user profile resource which depends on a sagemaker domain resource

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example" {
  vpc_id     = aws_vpc.example.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_sagemaker_domain" "example" {
  domain_name = "example"
  auth_mode   = "IAM"
  vpc_id      = aws_vpc.example.id
  subnet_ids  = [aws_subnet.example.id]

  default_user_settings {
    execution_role = aws_iam_role.example.arn
  }
}

resource "aws_iam_role" "example" {
  name               = "example"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.example.json
}

data "aws_iam_policy_document" "example" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

resource "aws_sagemaker_user_profile" "example" {
  domain_id         = aws_sagemaker_domain.example.id
  user_profile_name = "example"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false


aws_sagemaker_domain_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_domain"
}

aws_iam_role_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_vpc_valid(resources) if {
    some resource in resources
    resource.type == "aws_vpc"
}

aws_subnet_valid(resources) if {
    some resource in resources
    resource.type == "aws_subnet"
}

aws_sagemaker_user_profile_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_user_profile"
}

# Aggregate all checks
allow if {
    aws_sagemaker_domain_valid(input.resource_changes)
    aws_iam_role_valid(input.resource_changes)
    aws_vpc_valid(input.resource_changes)
    aws_subnet_valid(input.resource_changes)
    aws_sagemaker_user_profile_valid(input.resource_changes)
}

main if {
    allow
}
# Task 175


Create a sagemaker space resource.

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example" {
  vpc_id     = aws_vpc.example.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_sagemaker_domain" "example" {
  domain_name = "example"
  auth_mode   = "IAM"
  vpc_id      = aws_vpc.example.id
  subnet_ids  = [aws_subnet.example.id]

  default_user_settings {
    execution_role = aws_iam_role.example.arn
  }
}

resource "aws_iam_role" "example" {
  name               = "example"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.example.json
}

data "aws_iam_policy_document" "example" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

resource "aws_sagemaker_space" "example" {
  domain_id  = aws_sagemaker_domain.example.id
  space_name = "example"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false


aws_sagemaker_domain_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_domain"
}

aws_iam_role_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_vpc_valid(resources) if {
    some resource in resources
    resource.type == "aws_vpc"
}

aws_subnet_valid(resources) if {
    some resource in resources
    resource.type == "aws_subnet"
}

aws_sagemaker_space_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_space"
}

# Aggregate all checks
allow if {
    aws_sagemaker_domain_valid(input.resource_changes)
    aws_iam_role_valid(input.resource_changes)
    aws_vpc_valid(input.resource_changes)
    aws_subnet_valid(input.resource_changes)
    aws_sagemaker_space_valid(input.resource_changes)
}

main if {
    allow
}
# Task 176


Create a sagemaker_app resource configured to be a JupyterServer.

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region  = "us-east-1"
}

resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example" {
  vpc_id     = aws_vpc.example.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_iam_role" "example" {
  name               = "example"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.example.json
}

data "aws_iam_policy_document" "example" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

resource "aws_sagemaker_domain" "example" {
  domain_name = "example"
  auth_mode   = "IAM"
  vpc_id      = aws_vpc.example.id
  subnet_ids  = [aws_subnet.example.id]

  default_user_settings {
    execution_role = aws_iam_role.example.arn
  }
}

resource "aws_sagemaker_user_profile" "example" {
  domain_id         = aws_sagemaker_domain.example.id
  user_profile_name = "example"
}

resource "aws_sagemaker_app" "example" {
  domain_id         = aws_sagemaker_domain.example.id
  user_profile_name = aws_sagemaker_user_profile.example.user_profile_name
  app_name          = "example"
  app_type          = "JupyterServer"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false


aws_sagemaker_domain_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_domain"
}

aws_iam_role_valid(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_vpc_valid(resources) if {
    some resource in resources
    resource.type == "aws_vpc"
}

aws_subnet_valid(resources) if {
    some resource in resources
    resource.type == "aws_subnet"
}

aws_sagemaker_user_profile_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_user_profile"
}

aws_sagemaker_app_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_app"
}

# Aggregate all checks
allow if {
    aws_sagemaker_domain_valid(input.resource_changes)
    aws_iam_role_valid(input.resource_changes)
    aws_vpc_valid(input.resource_changes)
    aws_subnet_valid(input.resource_changes)
    aws_sagemaker_user_profile_valid(input.resource_changes)
    aws_sagemaker_app_valid(input.resource_changes)
}

main if {
    allow
}
# Task 177


Create a sagemaker_code_repository to aws_sagemaker_code_repository to "https://github.com/hashicorp/terraform-provider-aws.git"

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_sagemaker_code_repository" "example" {
  code_repository_name = "example"

  git_config {
    repository_url = "https://github.com/hashicorp/terraform-provider-aws.git"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false


aws_sagemaker_code_repository_valid(resources) if {
    some resource in resources
    resource.type == "aws_sagemaker_code_repository"
    resource.change.after.git_config[0].repository_url ==  "https://github.com/hashicorp/terraform-provider-aws.git"
}

# Aggregate all checks
allow if {
    aws_sagemaker_code_repository_valid(input.resource_changes)
}

main if {
    allow
}