znyang/ambig-iac huggingface dataset:
Task: sets up a basic AWS network infrastructure consisting of a Virtual Private Cloud (VPC) with a custom DHCP options set. The VPC is configured with a CIDR block The DHCP options include a domain name (windomain.local), a combination of custom and Google's DNS servers (192.168.56.102 and 8.8.8.8), and a NetBIOS name server (192.168.56.102). These DHCP options are then associated with the created VPC, customizing its DHCP settings.

Specification:
Has one "aws_vpc" resource:
Configured with a "cidr_block"
Includes associated custom DHCP options

Has one "aws_vpc_dhcp_options" resource:
Specifies a "domain_name" of "windomain.local"
Includes DNS servers with a combination of a custom DNS server ("192.168.56.102") and Google's DNS server ("8.8.8.8")
Configures a "NetBIOS" name server at "192.168.56.102"

Has one "aws_vpc_dhcp_options_association" resource:
Associates the "aws_vpc_dhcp_options" with the created "aws_vpc"
Customizes DHCP settings specifically for the created VPC environment

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_vpc" "default" {
  cidr_block = "192.168.0.0/16"
}

resource "aws_vpc_dhcp_options" "default" {
  domain_name          = "windomain.local"
  domain_name_servers  = concat(["192.168.56.102"], ["8.8.8.8"])
  netbios_name_servers = ["192.168.56.102"]
}

resource "aws_vpc_dhcp_options_association" "default" {
  vpc_id          = aws_vpc.default.id
  dhcp_options_id = aws_vpc_dhcp_options.default.id
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation states
default is_valid_vpc = false

default is_valid_dhcp_options = false

default is_valid_dhcp_options_association = false

# Validate aws_vpc resource
is_valid_vpc {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_vpc"
        resource.expressions.cidr_block.constant_value != null
}

# Validate aws_vpc_dhcp_options resource
is_valid_dhcp_options {
        some i
        resource := input.planned_values.root_module.resources[i]
        resource.type == "aws_vpc_dhcp_options"
        resource.values.domain_name == "windomain.local"
    resource.values.domain_name_servers == ["192.168.56.102", "8.8.8.8"]
        resource.values.netbios_name_servers == ["192.168.56.102"]
}

# Validate aws_vpc_dhcp_options_association resource
is_valid_dhcp_options_association {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_vpc_dhcp_options_association"
        resource.expressions.dhcp_options_id.references[0] == "aws_vpc_dhcp_options.default.id"
        resource.expressions.vpc_id.references[0] == "aws_vpc.default.id"
}
Task: sets up a basic AWS network infrastructure consisting of a Virtual Private Cloud (VPC) with a custom DHCP options set. The VPC is configured with a CIDR block of 192.168.0.0/16. The DHCP options include a domain name (windomain.local), a combination of custom and Google's DNS servers, and a NetBIOS name server (192.168.56.102). These DHCP options are then associated with the created VPC, customizing its DHCP settings.

Specification:
Has one "aws_vpc" resource:
Configured with a "cidr_block" of "192.168.0.0/16"
Includes associated custom DHCP options

Has one "aws_vpc_dhcp_options" resource:
Specifies a "domain_name" of "windomain.local"
Includes DNS servers with a combination of a custom DNS server and Google's DNS server
Configures a "NetBIOS" name server at "192.168.56.102"

Has one "aws_vpc_dhcp_options_association" resource:
Associates the "aws_vpc_dhcp_options" with the created "aws_vpc"
Customizes DHCP settings specifically for the created VPC environment

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_vpc" "default" {
  cidr_block = "192.168.0.0/16"
}

resource "aws_vpc_dhcp_options" "default" {
  domain_name          = "windomain.local"
  domain_name_servers  = concat(["192.168.56.102"], ["8.8.8.8"])
  netbios_name_servers = ["192.168.56.102"]
}

resource "aws_vpc_dhcp_options_association" "default" {
  vpc_id          = aws_vpc.default.id
  dhcp_options_id = aws_vpc_dhcp_options.default.id
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation states
default is_valid_vpc = false

default is_valid_dhcp_options = false

default is_valid_dhcp_options_association = false

# Validate aws_vpc resource
is_valid_vpc {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_vpc"
        resource.expressions.cidr_block.constant_value == "192.168.0.0/16"
}

# Validate aws_vpc_dhcp_options resource
is_valid_dhcp_options {
        some i
        resource := input.planned_values.root_module.resources[i]
        resource.type == "aws_vpc_dhcp_options"
        resource.values.domain_name == "windomain.local"
        resource.values.domain_name_servers != null
        resource.values.netbios_name_servers == ["192.168.56.102"]
}

# Validate aws_vpc_dhcp_options_association resource
is_valid_dhcp_options_association {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_vpc_dhcp_options_association"
        resource.expressions.dhcp_options_id.references[0] == "aws_vpc_dhcp_options.default.id"
        resource.expressions.vpc_id.references[0] == "aws_vpc.default.id"
}
Task: sets up a basic AWS network infrastructure consisting of a Virtual Private Cloud (VPC) with a custom DHCP options set. The VPC is configured with a CIDR block of 192.168.0.0/16. The DHCP options include a domain name (windomain.local), a combination of custom and Google's DNS servers (192.168.56.102 and 8.8.8.8), and a NetBIOS name server. These DHCP options are then associated with the created VPC, customizing its DHCP settings.

Specification:
Has one "aws_vpc" resource:
Configured with a "cidr_block" of "192.168.0.0/16"
Includes associated custom DHCP options

Has one "aws_vpc_dhcp_options" resource:
Specifies a "domain_name" of "windomain.local"
Includes DNS servers with a combination of a custom DNS server ("192.168.56.102") and Google's DNS server ("8.8.8.8")
Configures a "NetBIOS" name server

Has one "aws_vpc_dhcp_options_association" resource:
Associates the "aws_vpc_dhcp_options" with the created "aws_vpc"
Customizes DHCP settings specifically for the created VPC environment

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_vpc" "default" {
  cidr_block = "192.168.0.0/16"
}

resource "aws_vpc_dhcp_options" "default" {
  domain_name          = "windomain.local"
  domain_name_servers  = concat(["192.168.56.102"], ["8.8.8.8"])
  netbios_name_servers = ["192.168.56.102"]
}

resource "aws_vpc_dhcp_options_association" "default" {
  vpc_id          = aws_vpc.default.id
  dhcp_options_id = aws_vpc_dhcp_options.default.id
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation states
default is_valid_vpc = false

default is_valid_dhcp_options = false

default is_valid_dhcp_options_association = false

# Validate aws_vpc resource
is_valid_vpc {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_vpc"
        resource.expressions.cidr_block.constant_value == "192.168.0.0/16"
}

# Validate aws_vpc_dhcp_options resource
is_valid_dhcp_options {
        some i
        resource := input.planned_values.root_module.resources[i]
        resource.type == "aws_vpc_dhcp_options"
        resource.values.domain_name == "windomain.local"
    resource.values.domain_name_servers == ["192.168.56.102", "8.8.8.8"]
        resource.values.netbios_name_servers != null
}

# Validate aws_vpc_dhcp_options_association resource
is_valid_dhcp_options_association {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_vpc_dhcp_options_association"
        resource.expressions.dhcp_options_id.references[0] == "aws_vpc_dhcp_options.default.id"
        resource.expressions.vpc_id.references[0] == "aws_vpc.default.id"
}
Task: creates a NAT Gateway associated with a specified subnet and Elastic IP allocation ID. The NAT Gateway is configured for public connectivity and tagged with a key-value pair (pike = "permissions"), indicating its purpose or ownership.

Specification:
Has one "aws_nat_gateway" resource:
Associated with a specified "aws_subnet" resource for hosting the NAT Gateway.
Utilizes an "Elastic IP allocation ID" to provide the NAT Gateway with a public IP address.
Configured for public connectivity, allowing resources within the private subnet to access the internet securely.
Tagged with a key-value pair: "pike" set to "permissions", which categorizes its role, purpose, or ownership within the infrastructure.

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_nat_gateway" "pike" {
  subnet_id         = "subnet-0562ef1d304b968f4"
  allocation_id     = "eipalloc-0047fa56c40637c3b"
  connectivity_type = "public"
  tags = {
    pike = "permissions"
  }
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation state
default is_valid_nat_gateway = false

# Validate aws_nat_gateway resource
is_valid_nat_gateway {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_nat_gateway"

        # Ensure it is associated with a specified subnet
        resource.expressions.subnet_id != null

        # Ensure it uses a specific Elastic IP allocation ID
        resource.expressions.allocation_id != null

        # Check for the specific tag indicating its purpose or ownership
        resource.expressions.tags.constant_value.pike == "permissions"
}
Task: creates a NAT Gateway associated with a specified subnet and Elastic IP allocation ID. The NAT Gateway is configured for public connectivity.

Specification:
Has one "aws_nat_gateway" resource:
Associated with a specified "aws_subnet" resource for hosting the NAT Gateway.
Utilizes an "Elastic IP allocation ID" to provide the NAT Gateway with a public IP address.
Configured for public connectivity, allowing resources within the private subnet to access the internet securely.

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_nat_gateway" "pike" {
  subnet_id         = "subnet-0562ef1d304b968f4"
  allocation_id     = "eipalloc-0047fa56c40637c3b"
  connectivity_type = "public"
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation state
default is_valid_nat_gateway = false

# Validate aws_nat_gateway resource
is_valid_nat_gateway {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_nat_gateway"

        # Ensure it is associated with a specified subnet
        resource.expressions.subnet_id != null

        # Ensure it uses a specific Elastic IP allocation ID
        resource.expressions.allocation_id != null
}
Task: establishes a VPC peering connection between two AWS Virtual Private Clouds (VPCs). The first VPC, named "peer," is configured with a CIDR block of 10.0.0.0/24, and the second VPC, named "base," has a CIDR block of 10.1.0.0/24. The peering connection, named "pike," connects these two VPCs, allowing them to communicate with each other as if they were in the same network, and is tagged with pike = "permissions" to indicate its purpose or management policy.

Specification:
Has two "aws_vpc" resources:
The first VPC is named "peer" and is configured with a "cidr_block" of "10.0.0.0/24".
The second VPC is named "base" and is configured with a "cidr_block" of "10.1.0.0/24".

Has one "aws_vpc_peering_connection" resource:
Named "pike" to connect the two specified VPCs ("peer" and "base").
Configured to allow the VPCs to communicate with each other as if they were in the same network.
Tagged with "pike" set to "permissions", indicating its purpose or management policy within the infrastructure.

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_vpc_peering_connection" "pike" {
  peer_vpc_id = aws_vpc.peer.id
  vpc_id      = aws_vpc.base.id

  tags = {
    pike = "permissions"
  }
}

resource "aws_vpc" "peer" {
  cidr_block = "10.0.0.0/24"
}

resource "aws_vpc" "base" {
  cidr_block = "10.1.0.0/24"
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation states
default is_valid_vpcs = false
default is_valid_vpc_peering_connection = false

# Validate aws_vpc resources
is_valid_vpcs {
    # Validate the first VPC named "peer"
    peer_vpc := input.configuration.root_module.resources[_]
    peer_vpc.type == "aws_vpc"
    peer_vpc.name == "peer"
    peer_vpc.expressions.cidr_block.constant_value == "10.0.0.0/24"

    # Validate the second VPC named "base"
    base_vpc := input.configuration.root_module.resources[_]
    base_vpc.type == "aws_vpc"
    base_vpc.name == "base"
    base_vpc.expressions.cidr_block.constant_value == "10.1.0.0/24"

    # Ensure different VPCs
    peer_vpc != base_vpc
}

# Validate aws_vpc_peering_connection resource
is_valid_vpc_peering_connection {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_vpc_peering_connection"
    resource.name == "pike"
    # Ensure connection between "peer" and "base" VPCs
    resource.expressions.peer_vpc_id.references[0] == "aws_vpc.peer.id"
    resource.expressions.vpc_id.references[0] == "aws_vpc.base.id"
    # Check for the specific tag indicating its purpose
    resource.expressions.tags.constant_value["pike"] == "permissions"
}
Task: establishes a VPC peering connection between two AWS Virtual Private Clouds (VPCs). The first VPC, named "peer," is configured with a CIDR block of 10.0.0.0/24, and the second VPC, named "base," has a CIDR block of 10.1.0.0/24. The peering connection, named "pike," connects these two VPCs, allowing them to communicate with each other as if they were in the same network

Specification:
Has two "aws_vpc" resources:
The first VPC is named "peer" and is configured with a "cidr_block" of "10.0.0.0/24".
The second VPC is named "base" and is configured with a "cidr_block" of "10.1.0.0/24".

Has one "aws_vpc_peering_connection" resource:
Named "pike" to connect the two specified VPCs ("peer" and "base").
Configured to allow the VPCs to communicate with each other as if they were in the same network.

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_vpc_peering_connection" "pike" {
  peer_vpc_id = aws_vpc.peer.id
  vpc_id      = aws_vpc.base.id

}

resource "aws_vpc" "peer" {
  cidr_block = "10.0.0.0/24"
}

resource "aws_vpc" "base" {
  cidr_block = "10.1.0.0/24"
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation states
default is_valid_vpcs = false
default is_valid_vpc_peering_connection = false

# Validate aws_vpc resources
is_valid_vpcs {
    # Validate the first VPC named "peer"
    peer_vpc := input.configuration.root_module.resources[_]
    peer_vpc.type == "aws_vpc"
    peer_vpc.name == "peer"
    peer_vpc.expressions.cidr_block.constant_value == "10.0.0.0/24"

    # Validate the second VPC named "base"
    base_vpc := input.configuration.root_module.resources[_]
    base_vpc.type == "aws_vpc"
    base_vpc.name == "base"
    base_vpc.expressions.cidr_block.constant_value == "10.1.0.0/24"

    # Ensure different VPCs
    peer_vpc != base_vpc
}

# Validate aws_vpc_peering_connection resource
is_valid_vpc_peering_connection {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_vpc_peering_connection"
    resource.name == "pike"
    # Ensure connection between "peer" and "base" VPCs
    resource.expressions.peer_vpc_id.references[0] == "aws_vpc.peer.id"
    resource.expressions.vpc_id.references[0] == "aws_vpc.base.id"
    
}
Task: establishes a VPC peering connection between two AWS Virtual Private Clouds (VPCs). The first VPC name is "peer," and the second VPC name is "base". The peering connection, named "pike," connects these two VPCs, allowing them to communicate with each other as if they were in the same network, and is tagged with pike = "permissions" to indicate its purpose or management policy.

Specification:
Has two "aws_vpc" resources:
The first VPC is named "peer"
The second VPC is named "base"

Has one "aws_vpc_peering_connection" resource:
Named "pike" to connect the two specified VPCs ("peer" and "base").
Configured to allow the VPCs to communicate with each other as if they were in the same network.
Tagged with "pike" set to "permissions", indicating its purpose or management policy within the infrastructure.

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_vpc_peering_connection" "pike" {
  peer_vpc_id = aws_vpc.peer.id
  vpc_id      = aws_vpc.base.id

  tags = {
    pike = "permissions"
  }
}

resource "aws_vpc" "peer" {
  cidr_block = "10.0.0.0/24"
}

resource "aws_vpc" "base" {
  cidr_block = "10.1.0.0/24"
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation states
default is_valid_vpcs = false
default is_valid_vpc_peering_connection = false

# Validate aws_vpc resources
is_valid_vpcs {
    # Validate the first VPC named "peer"
    peer_vpc := input.configuration.root_module.resources[_]
    peer_vpc.type == "aws_vpc"
    peer_vpc.name == "peer"

    # Validate the second VPC named "base"
    base_vpc := input.configuration.root_module.resources[_]
    base_vpc.type == "aws_vpc"
    base_vpc.name == "base"
   
    # Ensure different VPCs
    peer_vpc != base_vpc
}

# Validate aws_vpc_peering_connection resource
is_valid_vpc_peering_connection {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_vpc_peering_connection"
    resource.name == "pike"
    # Ensure connection between "peer" and "base" VPCs
    resource.expressions.peer_vpc_id.references[0] == "aws_vpc.peer.id"
    resource.expressions.vpc_id.references[0] == "aws_vpc.base.id"
    # Check for the specific tag indicating its purpose
    resource.expressions.tags.constant_value["pike"] == "permissions"
}
Task: defines a default network ACL with unrestricted ingress and egress rules allowing all traffic from and to any source.

Specification:
Has one "aws_default_network_acl" resource:
with unrestricted ingress and egress rules allowing all traffic

Terraform configuration (main.tf):
provider "aws" {
  region = "us-west-1"
}

resource "aws_default_network_acl" "pike" {
  default_network_acl_id = "acl-01c8f6820c190c9dd"
  ingress {
    protocol   = -1
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 0
    to_port    = 0
  }

  egress {
    protocol   = -1
    rule_no    = 100
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 0
    to_port    = 0
  }
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation states
default is_valid_network_acl = false

# Validate aws_default_network_acl resources
is_valid_network_acl {
        some i
        network_acl := input.configuration.root_module.resources[i]
        network_acl.type == "aws_default_network_acl"
        
        # Check ingress rules for unrestricted access
        ingress := network_acl.expressions.ingress
        ingress[0].protocol.constant_value == -1
    ingress[0].action.constant_value == "allow"
        ingress[0].cidr_block.constant_value == "0.0.0.0/0"
        ingress[0].from_port.constant_value == 0
        ingress[0].to_port.constant_value == 0

        # Check egress rules for unrestricted access
        egress := network_acl.expressions.egress
        egress[0].protocol.constant_value == -1
        egress[0].action.constant_value == "allow"
        egress[0].cidr_block.constant_value == "0.0.0.0/0"
        egress[0].from_port.constant_value == 0
        egress[0].to_port.constant_value == 0

}