iac-eval-v2/iac-eval-v2 huggingface dataset:
# Task 127


Create an AWS aws_ami for the latest Amazon Linux 2 AMI. Set the cpu count to 2 and cores per threads per core to 2

## Intent

create aws_ami resource with cpu_count = 2 and cores_per_thread=2

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  # Configure your AWS provider settings here
  region = "us-east-1"  # Update with your desired AWS region
}

data "aws_ami" "latest_amazon_linux_2" {
  most_recent = true

  owners = ["amazon"]

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }

  filter {
    name   = "root-device-type"
    values = ["ebs"]
  }
}

resource "aws_instance" "example_instance" {
  ami           = data.aws_ami.latest_amazon_linux_2.id
  instance_type = "t3.2xlarge"

  cpu_options {
    core_count       = 2
    threads_per_core = 2
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

allow if {
    check_aws_instance(input.resource_changes)
}

check_aws_instance(resources) if {
    some resource in resources
    resource.type == "aws_instance"
    check_cpu_options(resource)
}

check_cpu_options(aws_instance) if {
	aws_instance.change.after.cpu_options[0].core_count == 2
	aws_instance.change.after.cpu_options[0].threads_per_core == 2
}

main if {
    allow
}
# Task 132


VPC with public and private subnets. Define 3 EC2 instances within an EC2 placement group. Use clustering.

## Intent

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

# Create a Virtual Private Cloud (VPC)
resource "aws_vpc" "my_vpc" {
  cidr_block = "10.0.0.0/16"
}

# Create Public Subnet
resource "aws_subnet" "public_subnet" {
  vpc_id                  = aws_vpc.my_vpc.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "us-east-1a"
  map_public_ip_on_launch = true
}

data "aws_availability_zones" "azs" {
    state = "available"
}

# Create Private Subnet
resource "aws_subnet" "private_subnet" {
  vpc_id            = aws_vpc.my_vpc.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = data.aws_availability_zones.azs.names[0]
}

# Create EC2 Placement Group
resource "aws_placement_group" "my_placement_group" {
  name     = "my-placement-group"
  strategy = "cluster"
}

# Create Security Group for EC2 instances
resource "aws_security_group" "ec2_sg" {
  vpc_id = aws_vpc.my_vpc.id
  name   = "ec2_sg"
}

data "aws_ami" "amzn2" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["*ubuntu-noble-24.04-amd64-server-*"]
  }
}

# Create EC2 instances in the Placement Group in the Private Subnet
resource "aws_instance" "ec2_instance" {
  count           = 3
  ami             = data.aws_ami.amzn2.id
  instance_type   = "m5.large"
  subnet_id       = aws_subnet.private_subnet.id
  security_groups = [aws_security_group.ec2_sg.id]
  placement_group = aws_placement_group.my_placement_group.name
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check for VPC with public and private subnets
vpc_exists if {
    some i
    input.resource_changes[i].type == "aws_vpc"
}

public_subnet_exists(resources) if {
    some resource in resources
    resource.type == "aws_subnet"
    resource.change.after.map_public_ip_on_launch == true
}

private_subnet_exists(resources) if {
    some resource in resources
    resource.type == "aws_subnet"
    resource.change.after.map_public_ip_on_launch == false
}

aws_instances contains resource if {
    resource := input.resource_changes[_]
    resource.type == "aws_instance"
}

# Aggregate all checks
allow if {
    vpc_exists
    public_subnet_exists(input.resource_changes)
    private_subnet_exists(input.resource_changes)
    count(aws_instances) == 3
}

main if {
    allow
}
# Task 133


Provide a Memcached Cluster

## Intent

requires cluster id, engine=memcached, node_type, num_cache_nodes, parameter_group_name

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region="us-east-1"
}
resource "aws_elasticache_cluster" "example" {
  cluster_id           = "cluster-example"
  engine               = "memcached"
  node_type            = "cache.m4.large"
  num_cache_nodes      = 2
  parameter_group_name = "default.memcached1.4"
  port                 = 11211
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_elasticache_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_cluster"
    resource.change.after.engine == "memcached"
}

# Aggregate all checks
allow if {
    aws_elasticache_cluster_valid(input.resource_changes)
}

main if {
    allow
}
# Task 134


Provide a Redis Instance

## Intent

requires cluster id, engine=redis, node_type, num_cache_nodes, parameter_group_name

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_elasticache_cluster" "example" {
  cluster_id           = "cluster-example"
  engine               = "redis"
  node_type            = "cache.m4.large"
  num_cache_nodes      = 1
  parameter_group_name = "default.redis3.2"
  engine_version       = "3.2.10"
  port                 = 6379
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_elasticache_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_cluster"
    resource.change.after.engine == "redis"
}

# Aggregate all checks
allow if {
    aws_elasticache_cluster_valid(input.resource_changes)
}

main if {
    allow
}
# Task 135


Provide an ElastiCache user resource with redis

## Intent

requires access string, engine = REDIS, user id and user name

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
  engine        = "REDIS"
  passwords     = ["password123456789"]
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_elasticache_user_valid(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.engine == "REDIS"
}

# Aggregate all checks
allow if {
    aws_elasticache_user_valid(input.resource_changes)
}

main if {
    allow
}
# Task 136


Provide an ElastiCache user resource with iam

## Intent

requires access string, engine = REDIS, user id and user name, authentication_mode {type = "iam"}

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~* +@all"
  engine        = "REDIS"

  authentication_mode {
    type = "iam"
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_elasticache_user_valid(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.authentication_mode[_].type == "iam"
}

# Aggregate all checks
allow if {
    aws_elasticache_user_valid(input.resource_changes)
}

main if {
    allow
}
# Task 137


Provide an ElastiCache user resource with password.

## Intent

requires access string, engine = REDIS, user id and user name, authentication_mode {type= "password", passwords = ["password1", "password2"]}

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~* +@all"
  engine        = "REDIS"

  authentication_mode {
    type      = "password"
    passwords = ["password1", "password2"]
  }
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_elasticache_user_valid(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.authentication_mode[_].type == "password"
}

# Aggregate all checks
allow if {
    aws_elasticache_user_valid(input.resource_changes)
}

main if {
    allow
}
# Task 138


Provide an ElastiCache user group resource.

## Intent

creates elasticache user resources(requires access string, engine = REDIS, user id and user name) and sets engine , creates group resource using the user ids

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "default"
  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
  engine        = "REDIS"
  passwords     = ["password123456789"]
}

resource "aws_elasticache_user_group" "test" {
  engine        = "REDIS"
  user_group_id = "userGroupId"
  user_ids      = [aws_elasticache_user.test.user_id]
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_elasticache_user_group_valid(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user_group"
}

# Aggregate all checks
allow if {
    aws_elasticache_user_group_valid(input.resource_changes)
}

main if {
    allow
}
# Task 139


Associate an existing ElastiCache user and an existing user group.

## Intent

creates elasticache user group and a user resource then associates the 2 using ids

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_elasticache_user" "default" { 
  user_id = "defaultUserID" 
  user_name = "default" 
  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember" 
  engine = "REDIS" 
  passwords = ["password123456789"] 
} 

resource "aws_elasticache_user_group" "example"{ 
  engine = "REDIS" 
  user_group_id = "userGroupId" 
  user_ids = [aws_elasticache_user.default.user_id] 
  lifecycle { ignore_changes = [user_ids] } 
} 

resource "aws_elasticache_user" "example" { 
  user_id = "exampleUserID" 
  user_name = "exampleuser" 
  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember" 
  engine = "REDIS" 
  passwords = ["password123456789"] 
} 

resource "aws_elasticache_user_group_association" "example" { 
  user_group_id = aws_elasticache_user_group.example.user_group_id 
  user_id = aws_elasticache_user.example.user_id 
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

# Check if AWS ElastiCache user group exists
aws_elasticache_user_group_exists(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user_group"
    resource.change.actions[_] == "create"
}

# Check if AWS ElastiCache user exists
aws_elasticache_user_exists(resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.actions[_] == "create"
}

# Check if AWS ElastiCache user group association is valid
aws_elasticache_user_group_association_valid(resources) if {
    aws_elasticache_user_exists(resources)
    aws_elasticache_user_group_exists(resources)

    some resource in resources
    resource.type == "aws_elasticache_user_group_association"
    resource.change.actions[_] == "create"
    user_id := resource.change.after.user_id
    group_id := resource.change.after.user_group_id

    user_id_exists(user_id, resources)
    group_id_exists(group_id, resources)
}

# Helper functions to check if user_id and group_id exist in the resources
user_id_exists(user_id, resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.user_id == user_id
}

group_id_exists(group_id, resources) if {
    some resource in resources
    resource.type == "aws_elasticache_user_group"
    resource.change.after.user_group_id == group_id
}

# Aggregate all checks
allow if {
    aws_elasticache_user_group_association_valid(input.resource_changes)
}

main if {
    allow
}
# Task 140


Create a RedShift cluster resource with a single node

## Intent

Has an aws_redshift_cluster resource and check cluster_type is "single_node" or number of nodes is 1

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "tf-redshift-cluster"
  database_name      = "mydb"
  master_username    = "exampleuser"
  master_password    = "Mustbe8characters"
  node_type          = "dc2.large"
  cluster_type       = "single-node"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_redshift_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 1
}

# Aggregate all checks
allow if {
    aws_redshift_cluster_valid(input.resource_changes)
}

main if {
    allow
}
# Task 141


Create a 2 node RedShift cluster and limit the concurrency scaling to 60 minutes

## Intent

Has an aws_redshift_cluster resource and check cluster_type is "single_node" or number of nodes is 2, check there is a aws_redshift_usage_limit resouce where the feature type is concurrency_scaling, limit_type is "time", and amount is 60

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "redshift-cluster-1"
  node_type          = "dc2.large"
  number_of_nodes    = 2

  database_name = "mydb"
  master_username = "foo"
  master_password = "Mustbe8characters"

  skip_final_snapshot = true
}

resource "aws_redshift_usage_limit" "example" {
  cluster_identifier = aws_redshift_cluster.example.id
  feature_type       = "concurrency-scaling"
  limit_type         = "time"
  amount             = 60
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_redshift_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 2
}

aws_redshift_usage_limit_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_usage_limit"
    resource.change.after.feature_type == "concurrency-scaling"
    resource.change.after.limit_type == "time"
    resource.change.after.amount == 60
}

# Aggregate all checks
allow if {
    aws_redshift_cluster_valid(input.resource_changes)
    aws_redshift_usage_limit_valid(input.resource_changes)
}

main if {
    allow
}
# Task 142


Create a 2 node RedShift cluster and create a new Amazon Redshift endpoint authorization for an account with AWS id 012345678910

## Intent

Has an aws_redshift_resouce with 2 nodes and creates a aws_redshift_endpoint_authorization resource with account =012345678910

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "redshift-cluster-1"
  node_type          = "dc2.large"
  number_of_nodes    = 2

  database_name = "mydb"
  master_username = "foo"
  master_password = "Mustbe8characters"

  skip_final_snapshot = true
}

resource "aws_redshift_endpoint_authorization" "example" {
  account            = "012345678910"
  cluster_identifier = aws_redshift_cluster.example.cluster_identifier
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_redshift_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 2
}

# Function to check if Redshift snapshot schedule is every 12 hours
aws_redshift_endpoint_authorization_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_endpoint_authorization"
    resource.change.after.account == "012345678910"
}

# Aggregate all checks
allow if {
    aws_redshift_cluster_valid(input.resource_changes)
    aws_redshift_endpoint_authorization_valid(input.resource_changes)
}

main if {
    allow
}
# Task 143


Create a 1 node RedShift cluster and automatically create a snapshot every 12 hours

## Intent

Has an aws_redshift resouce with 1 node and aws_redshift_snapshot_schedule resource with rate set to 12 hours. Then have a aws_redshift_snapshot_schedle_association to conect the 2

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "redshift-cluster-1"
  node_type          = "dc2.large"
  number_of_nodes    = 1

  database_name = "mydb"
  master_username = "foo"
  master_password = "Mustbe8characters"

  skip_final_snapshot = true
}

resource "aws_redshift_snapshot_schedule" "default" {
  identifier = "tf-redshift-snapshot-schedule"
  definitions = [
    "rate(12 hours)",
  ]
}

resource "aws_redshift_snapshot_schedule_association" "default" {
  cluster_identifier  = aws_redshift_cluster.example.id
  schedule_identifier = aws_redshift_snapshot_schedule.default.id
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_redshift_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 1
}

# Function to check if Redshift snapshot schedule is every 12 hours
aws_redshift_snapshot_schedule_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_snapshot_schedule"
    resource.change.after.definitions[_] == "rate(12 hours)"
}

# Aggregate all checks
allow if {
    aws_redshift_cluster_valid(input.resource_changes)
    aws_redshift_snapshot_schedule_valid(input.resource_changes)
}

main if {
    allow
}
# Task 146


Setup a 2 node RedShift cluster in us-east-1 and replicate it to us-east-2.

## Intent

Creates a redshift_clluster in us-east-1 and a snapshot_copy in us-east-2

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
  alias  = "useast1"
}

resource "aws_redshift_cluster" "primary_cluster" {
  provider = aws.useast1

  cluster_identifier  = "primary-cluster"
  database_name       = "mydatabase"
  master_username     = "myusername"
  master_password     = "Mypassword1"
  node_type           = "dc2.large"
  cluster_type        = "multi-node"
  number_of_nodes     = 2
  skip_final_snapshot = true
}

resource "aws_redshift_snapshot_copy" "primary_cluster" {
  cluster_identifier = aws_redshift_cluster.primary_cluster.id
  destination_region = "us-east-2"
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_redshift_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 2
}

aws_redshift_snapshot_copy_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_snapshot_copy"
    resource.change.after.destination_region == "us-east-2"
}

allow if {
    aws_redshift_cluster_valid(input.resource_changes)
    aws_redshift_snapshot_copy_valid(input.resource_changes)
}

main if {
    allow
}
# Task 147


Create an IAM role and a redshift cluster and associate the IAM role with the RedShift cluster.

## Intent

Create a aws_iam_role, aws_redshift_cluster, and attach the role to the cluster

## Reference Terraform solution

terraform {
  required_version = ">= 1.15.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

resource "aws_iam_role" "redshift_role" {
  name = "redshift_role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = "sts:AssumeRole",
        Effect = "Allow",
        Principal = {
          Service = "redshift.amazonaws.com"
        },
      },
    ],
  })
}

resource "aws_iam_role_policy_attachment" "redshift_s3_read_only" {
  role       = aws_iam_role.redshift_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "tf-redshift-cluster"
  database_name      = "mydb"
  master_username    = "foo"
  master_password    = "Mustbe8characters"
  node_type          = "dc2.large"
  cluster_type       = "single-node"

  depends_on = [aws_iam_role.redshift_role]
}

resource "aws_redshift_cluster_iam_roles" "example" {
  cluster_identifier = aws_redshift_cluster.example.id
  iam_role_arns      = [aws_iam_role.redshift_role.arn]
}


## OPA Rego validation policy

package terraform.policy

import rego.v1

default allow = false

aws_redshift_cluster_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 1
}

iam_role_vaild(resources) if {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_iam_role_policy_attachment(resources) if {
    some resource in resources
    resource.type == "aws_iam_role_policy_attachment"
}

aws_redshift_cluster_iam_roles_valid(resources) if {
    some resource in resources
    resource.type == "aws_redshift_cluster_iam_roles"
}

# Aggregate all checks
allow if {
    aws_redshift_cluster_valid(input.resource_changes)
    iam_role_vaild(input.resource_changes)
    aws_iam_role_policy_attachment(input.resource_changes)
    aws_redshift_cluster_iam_roles_valid(input.resource_changes)
}

main if {
    allow
}