Task: Create a Terraform script for an AWS EKS setup with pod identity management. Start by defining an IAM policy document (called "example") for assuming a role by EKS pods. Then, create an IAM role (called "example") using this policy. Attach a policy for S3 read-only access to this role. Finally, define an EKS pod identity association linking the role to a specific EKS cluster (called "example"), namespace, and service account.

Specification:
has one "data" block for "aws_iam_policy_document" named "assume_role"
with one "statement" block containing:
one "effect"
one "principals" block with "type" and "identifiers"
one "actions" list

has one "aws_iam_role" resource named "example"
with one "name"
with one "assume_role_policy" referencing the data block

has one "aws_iam_role_policy_attachment" resource named "example_s3"
with one "policy_arn"
with one "role" referencing the "aws_iam_role.example.name"

has one "aws_eks_pod_identity_association" resource named "example"
with one "cluster_name"
with one "namespace"
with one "service_account"
with one "role_arn" referencing the "aws_iam_role.example.arn"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region  = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example1" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_subnet" "example2" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.2.0/24"
}

resource "aws_iam_role" "example1" {
  name = "eks-cluster-1"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example1.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example1.name
}

resource "aws_eks_cluster" "example" {
  name     = "example"
  role_arn = aws_iam_role.example1.arn

  vpc_config {
    subnet_ids = [aws_subnet.example1.id, aws_subnet.example2.id]
  }

  depends_on = [ 
    aws_iam_role_policy_attachment.eks_cluster_policy,
    aws_iam_role_policy_attachment.eks_service_policy,
  ]
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["pods.eks.amazonaws.com"]
    }

    actions = [
      "sts:AssumeRole",
      "sts:TagSession"
    ]
  }
}

resource "aws_iam_role" "example" {
  name               = "eks-pod-identity-example"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

resource "aws_iam_role_policy_attachment" "example_s3" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
  role       = aws_iam_role.example.name
}

resource "aws_eks_pod_identity_association" "example" {
  cluster_name    = aws_eks_cluster.example.name
  namespace       = "example"
  service_account = "example-sa"
  role_arn        = aws_iam_role.example.arn
}

Validation policy (checks.rego):
package terraform.validation

default has_aws_iam_policy_document_assume_role = false
default has_aws_iam_role_example = false
default has_aws_iam_role_policy_attachment_example_s3 = false
default has_aws_eks_pod_identity_association_example = false

has_aws_iam_policy_document_assume_role {
    assume_role := input.configuration.root_module.resources[_]
    assume_role.type == "aws_iam_policy_document"
    assume_role.expressions.statement[_].effect.constant_value == "Allow"
    assume_role.expressions.statement[_].principals[_].type.constant_value == "Service"
    assume_role.expressions.statement[_].principals[_].identifiers.constant_value[_] == "pods.eks.amazonaws.com"
    count(assume_role.expressions.statement[_].actions.constant_value) == 2
    assume_role.expressions.statement[_].actions.constant_value[_] == "sts:AssumeRole"
    assume_role.expressions.statement[_].actions.constant_value[_] == "sts:TagSession"
}

has_aws_iam_role_example {
    role := input.configuration.root_module.resources[_]
    role.type == "aws_iam_role"
    role.name == "example"
    role.expressions.assume_role_policy != null
}

has_aws_iam_role_policy_attachment_example_s3 {
    policy_attachment := input.configuration.root_module.resources[_]
    policy_attachment.type == "aws_iam_role_policy_attachment"
    policy_attachment.name == "example_s3"
    policy_attachment.expressions.policy_arn.constant_value == "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
    policy_attachment.expressions.role.references[_] == "aws_iam_role.example.name"
}

has_aws_eks_pod_identity_association_example {
    pod_identity := input.configuration.root_module.resources[_]
    pod_identity.type == "aws_eks_pod_identity_association"
    pod_identity.expressions.cluster_name.references[_] == "aws_eks_cluster.example.name"
    pod_identity.expressions.namespace.constant_value == "example"
    pod_identity.expressions.role_arn.references[_] == "aws_iam_role.example.arn"
}

valid_configuration {
    has_aws_iam_policy_document_assume_role
    has_aws_iam_role_example
    has_aws_iam_role_policy_attachment_example_s3
    has_aws_eks_pod_identity_association_example
}