znyang/ambig-iac huggingface dataset:
Task: Create an AWS Chime Voice Connector with encryption and log media metrics.

Specification:
Has one resource "aws_chime_voice_connector"
with require_encryption=true

Has one resource "aws_chime_voice_connector_logging"
with voice_connector_id equal to the id of the voice connector
with enable_media_metric_logs true

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_chime_voice_connector" "default" {
  name               = "vc-name-test"
  require_encryption = true
}

resource "aws_chime_voice_connector_logging" "default" {
  enable_sip_logs          = false
  enable_media_metric_logs = true
  voice_connector_id       = aws_chime_voice_connector.default.id
}

Validation policy (checks.rego):
package aws_chime_voice_connector
import future.keywords.in

default valid := false

valid {
    some vc in input.configuration.root_module.resources
    vc.type == "aws_chime_voice_connector"
    vc.expressions.require_encryption.constant_value == true

    some vc_logging in input.configuration.root_module.resources
    vc_logging.type = "aws_chime_voice_connector_logging"
    vc_logging.expressions.enable_media_metric_logs.constant_value == true
    vc.address in vc_logging.expressions.voice_connector_id.references
}
Task: Create an AWS Chime Voice Connector with encryption. Then configure the streaming of the voice connector with retention period of 5 hours, notifications sent to SNS, and disable streaming to Amazon Kinesis.

Specification:
Has one resource "aws_chime_voice_connector"
with require_encryption=true

Has one resource "aws_chime_voice_connector_streaming"
with voice_connector_id equal to the id of the voice connector
with streaming_enabled = false
with data_retention = 5
streaming_notification_targets = ["SNS"]

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_chime_voice_connector" "default" {
  name               = "vc-name-test"
  require_encryption = true
}

resource "aws_chime_voice_connector_streaming" "default" {
  disabled = false
  voice_connector_id  = aws_chime_voice_connector.default.id
  data_retention = 5
  streaming_notification_targets = ["SNS"]
}

Validation policy (checks.rego):
package aws_chime_voice_connector
import future.keywords.in

default valid := false

valid {
    some vc in input.configuration.root_module.resources
    vc.type == "aws_chime_voice_connector"
    vc.expressions.require_encryption.constant_value == true

    some vc_streaming in input.configuration.root_module.resources
    vc_streaming.type = "aws_chime_voice_connector_streaming"
    vc_streaming.expressions.data_retention.constant_value == 5
    vc_streaming.expressions.disabled.constant_value == false
    "SNS" in vc_streaming.expressions.streaming_notification_targets.constant_value
    vc.address in vc_streaming.expressions.voice_connector_id.references
}
Task: Create an AWS Chime Voice Connector. Then set up a configuration to stream media to Amazon Kinesis.

Specification:
Has one resource "aws_chime_voice_connector"

Has one resource "aws_chime_voice_connector_streaming"
with voice_connector_id equal to the id of the voice connector
with data_retention to some number

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_chime_voice_connector" "default" {
  name               = "vc-name-test"
  require_encryption = true
}

resource "aws_chime_voice_connector_streaming" "default" {
  voice_connector_id  = aws_chime_voice_connector.default.id
  data_retention = 5
}

Validation policy (checks.rego):
package aws_chime_voice_connector
import future.keywords.in

default valid := false

valid {
    some vc in input.configuration.root_module.resources
    vc.type == "aws_chime_voice_connector"
    vc.expressions.require_encryption.constant_value == true

    some vc_streaming in input.configuration.root_module.resources
    vc_streaming.type = "aws_chime_voice_connector_streaming"
    vc.address in vc_streaming.expressions.voice_connector_id.references
}
Task: Create an AWS Redshift cluster with endpoint access from two subnets

Specification:
Has one resource "aws_vpc"

Has one resource "aws_subnet"
with one "vpc_id" with value "aws_vpc.{VPC NAME}.id"

Has another resource "aws_subnet"
with one "vpc_id" with value "aws_vpc.{VPC NAME}.id"

Has one resource "aws_redshift_subnet_group"
with both subnet ids in subnet_ids

Has one resource "aws_redshift_cluster"

Has one resource "aws_redshift_endpoint_access"
with the subnet group referenced in subnet_group_name
and the cluster referenced in cluster_identifier

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "tf-redshift-cluster"
  database_name      = "mydb"
  master_username    = "exampleuser"
  master_password    = "Mustbe8characters"
  node_type          = "ra3.xlplus"
  cluster_type       = "single-node"
}

resource "aws_redshift_endpoint_access" "example" {
  endpoint_name      = "example"
  subnet_group_name  = aws_redshift_subnet_group.foobar.id
  cluster_identifier = aws_redshift_cluster.example.cluster_identifier
}

resource "aws_vpc" "foo" {
  cidr_block = "10.1.0.0/16"
}

data "aws_availability_zones" "azs" {
    state = "available"
}

resource "aws_subnet" "foo" {
  cidr_block        = "10.1.1.0/24"
  availability_zone = data.aws_availability_zones.azs.names[0]
  vpc_id            = aws_vpc.foo.id
}

resource "aws_subnet" "bar" {
  cidr_block        = "10.1.2.0/24"
  availability_zone = data.aws_availability_zones.azs.names[1]
  vpc_id            = aws_vpc.foo.id
}

resource "aws_redshift_subnet_group" "foobar" {
  name       = "foo"
  subnet_ids = [aws_subnet.foo.id, aws_subnet.bar.id]
}

Validation policy (checks.rego):
package aws_redshift_endpoint_access
import future.keywords.in

default valid := false

valid {
    some vpc in input.configuration.root_module.resources
    vpc.type == "aws_vpc"

    some subnet1 in input.configuration.root_module.resources
    subnet1.type == "aws_subnet"
    vpc.address in subnet1.expressions.vpc_id.references

    some subnet2 in input.configuration.root_module.resources
    subnet2.type == "aws_subnet"
    vpc.address in subnet2.expressions.vpc_id.references

    not subnet1 == subnet2
    
    some subnet_group in input.configuration.root_module.resources
    subnet_group.type == "aws_redshift_subnet_group"
    subnet1.address in subnet_group.expressions.subnet_ids.references
    subnet2.address in subnet_group.expressions.subnet_ids.references
    
    some cluster in input.configuration.root_module.resources
    cluster.type == "aws_redshift_cluster"
    
    some endpoint in input.configuration.root_module.resources
    endpoint.type == "aws_redshift_endpoint_access"
    cluster.address in endpoint.expressions.cluster_identifier.references
    subnet_group.address in endpoint.expressions.subnet_group_name.references
}
Task: Create an AWS Redshift cluster with notifications on events

Specification:
Has one resource "aws_sns_topic"

Has one resource "aws_redshift_cluster"

Has one resource "aws_redshift_event_subscription"
with source_type = "cluster"
and sns topic referenced in sns_topic_arn
and cluster referenced in source_ids

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "default"
  database_name      = "default"
  master_username    = "exampleuser"
  master_password    = "Mustbe8characters"
  node_type          = "ra3.xlplus"
  cluster_type       = "single-node"
}

resource "aws_sns_topic" "default" {
  name = "redshift-events"
}

resource "aws_redshift_event_subscription" "default" {
  name          = "redshift-event-sub"
  sns_topic_arn = aws_sns_topic.default.arn

  source_type = "cluster"
  source_ids  = [aws_redshift_cluster.example.id]

  severity = "INFO"

  event_categories = [
    "configuration",
    "management",
    "monitoring",
    "security",
  ]

  tags = {
    Name = "default"
  }
}

Validation policy (checks.rego):
package aws_redshift_cluster_event_subscription
import future.keywords.in

default valid := false

valid {
        some topic in input.configuration.root_module.resources
        topic.type == "aws_sns_topic"
    
        some cluster in input.configuration.root_module.resources
        cluster.type == "aws_redshift_cluster"

        some event_sub in input.configuration.root_module.resources
        event_sub.type == "aws_redshift_event_subscription"
    event_sub.expressions.source_type.constant_value == "cluster"
        topic.address in event_sub.expressions.sns_topic_arn.references
        cluster.address in event_sub.expressions.source_ids.references
}
Task: Create an AWS Redshift cluster with an AWS Redshift event subscription resource that sends events to an AWS SNS topic

Specification:
Has one resource "aws_sns_topic"

Has one resource "aws_redshift_cluster"

Has one resource "aws_redshift_event_subscription"
with source_type = "cluster"
and sns topic referenced in sns_topic_arn
and cluster referenced in source_ids

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "default"
  database_name      = "default"
  master_username    = "exampleuser"
  master_password    = "Mustbe8characters"
  node_type          = "ra3.xlplus"
  cluster_type       = "single-node"
}

resource "aws_sns_topic" "default" {
  name = "redshift-events"
}

resource "aws_redshift_event_subscription" "default" {
  name          = "redshift-event-sub"
  sns_topic_arn = aws_sns_topic.default.arn

  source_type = "cluster"
  source_ids  = [aws_redshift_cluster.example.id]

  severity = "INFO"

  event_categories = [
    "configuration",
    "management",
    "monitoring",
    "security",
  ]

  tags = {
    Name = "default"
  }
}

Validation policy (checks.rego):
package aws_redshift_cluster_event_subscription
import future.keywords.in

default valid := false

valid {
        some topic in input.configuration.root_module.resources
        topic.type == "aws_sns_topic"
    
        some cluster in input.configuration.root_module.resources
        cluster.type == "aws_redshift_cluster"

        some event_sub in input.configuration.root_module.resources
        event_sub.type == "aws_redshift_event_subscription"
    event_sub.expressions.source_type.constant_value == "cluster"
        topic.address in event_sub.expressions.sns_topic_arn.references
        cluster.address in event_sub.expressions.source_ids.references
}
Task: Create an AWS Redshift cluster with example cluster parameters and notifications on events associated with the parameter group

Specification:
Has one resource "aws_sns_topic"

Has one resource "aws_redshift_parameter_group"

Has one resource "aws_redshift_cluster"
with cluster_parameter_group_name = parameter group id

Has one resource "aws_redshift_event_subscription"
with source_type = "cluster-parameter-group"
and sns topic referenced in sns_topic_arn
and parameter group referenced in source_ids

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier  = "tf-redshift-cluster"
  database_name       = "mydb"
  master_username     = "exampleuser"
  master_password     = "Mustbe8characters"
  node_type           = "ra3.xlplus"
  cluster_type        = "single-node"
  skip_final_snapshot = true
  cluster_parameter_group_name = aws_redshift_parameter_group.bar.id
}

resource "aws_redshift_parameter_group" "bar" {
  name   = "parameter-group-test-terraform"
  family = "redshift-1.0"

  parameter {
    name  = "require_ssl"
    value = "true"
  }

  parameter {
    name  = "query_group"
    value = "example"
  }

  parameter {
    name  = "enable_user_activity_logging"
    value = "true"
  }
}

resource "aws_sns_topic" "default" {
  name = "redshift-events"
}

resource "aws_redshift_event_subscription" "default" {
  name          = "redshift-event-sub"
  sns_topic_arn = aws_sns_topic.default.arn

  source_type = "cluster-parameter-group"
  source_ids  = [aws_redshift_parameter_group.bar.id]

  severity = "INFO"

  event_categories = [
    "configuration",
    "management",
    "monitoring",
    "security",
  ]
}

Validation policy (checks.rego):
package aws_redshift_cluster_parameter_event_subscription
import future.keywords.in

default valid := false

valid {
	some topic in input.configuration.root_module.resources
	topic.type == "aws_sns_topic"

	some param_group in input.configuration.root_module.resources
	param_group.type == "aws_redshift_parameter_group"

	some cluster in input.configuration.root_module.resources
	cluster.type == "aws_redshift_cluster"
	param_group.address in cluster.expressions.cluster_parameter_group_name.references

	some event_sub in input.configuration.root_module.resources
	event_sub.type == "aws_redshift_event_subscription"
	event_sub.expressions.source_type.constant_value == "cluster-parameter-group"
	topic.address in event_sub.expressions.sns_topic_arn.references
	param_group.address in event_sub.expressions.source_ids.references
}
Task: Create an AWS Redshift cluster with an example AWS Redshift parameter group resource attached with an AWS Redshift event subscription resource that sends events associated with the parameter group to an AWS SNS topic.

Specification:
Has one resource "aws_sns_topic"

Has one resource "aws_redshift_parameter_group"

Has one resource "aws_redshift_cluster"
with cluster_parameter_group_name = parameter group id

Has one resource "aws_redshift_event_subscription"
with source_type = "cluster-parameter-group"
and sns topic referenced in sns_topic_arn
and parameter group referenced in source_ids

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier  = "tf-redshift-cluster"
  database_name       = "mydb"
  master_username     = "exampleuser"
  master_password     = "Mustbe8characters"
  node_type           = "ra3.xlplus"
  cluster_type        = "single-node"
  skip_final_snapshot = true
  cluster_parameter_group_name = aws_redshift_parameter_group.bar.id
}

resource "aws_redshift_parameter_group" "bar" {
  name   = "parameter-group-test-terraform"
  family = "redshift-1.0"

  parameter {
    name  = "require_ssl"
    value = "true"
  }

  parameter {
    name  = "query_group"
    value = "example"
  }

  parameter {
    name  = "enable_user_activity_logging"
    value = "true"
  }
}

resource "aws_sns_topic" "default" {
  name = "redshift-events"
}

resource "aws_redshift_event_subscription" "default" {
  name          = "redshift-event-sub"
  sns_topic_arn = aws_sns_topic.default.arn

  source_type = "cluster-parameter-group"
  source_ids  = [aws_redshift_parameter_group.bar.id]

  severity = "INFO"

  event_categories = [
    "configuration",
    "management",
    "monitoring",
    "security",
  ]
}

Validation policy (checks.rego):
package aws_redshift_cluster_parameter_event_subscription
import future.keywords.in

default valid := false

valid {
	some topic in input.configuration.root_module.resources
	topic.type == "aws_sns_topic"

	some param_group in input.configuration.root_module.resources
	param_group.type == "aws_redshift_parameter_group"

	some cluster in input.configuration.root_module.resources
	cluster.type == "aws_redshift_cluster"
	param_group.address in cluster.expressions.cluster_parameter_group_name.references

	some event_sub in input.configuration.root_module.resources
	event_sub.type == "aws_redshift_event_subscription"
	event_sub.expressions.source_type.constant_value == "cluster-parameter-group"
	topic.address in event_sub.expressions.sns_topic_arn.references
	param_group.address in event_sub.expressions.source_ids.references
}
Task: Create two basic AWS IAM users that are a part of a basic IAM group

Specification:
Has one "aws_iam_group" resource
with one "name" with any value

Has one "aws_iam_user" resource
with one "name" with any value

Has another "aws_iam_user" resource
with one "name" with any value

Has one "aws_iam_group_membership" resource
with one "name" with any value
with one "users" with the two user resource names
with one "group" with the group resource name

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_group_membership" "team" {
  name = "tf-testing-group-membership"

  users = [
    aws_iam_user.user_one.name,
    aws_iam_user.user_two.name,
  ]

  group = aws_iam_group.group.name
}

resource "aws_iam_group" "group" {
  name = "test-group"
}

resource "aws_iam_user" "user_one" {
  name = "test-user"
}

resource "aws_iam_user" "user_two" {
  name = "test-user-two"
}

Validation policy (checks.rego):
package iam_group_two_users
import future.keywords.in

default valid := false

valid {
    some user1 in input.configuration.root_module.resources
    user1.type == "aws_iam_user"

    some user2 in input.configuration.root_module.resources
    user2.type == "aws_iam_user"

    not user1 == user2

    some group in input.configuration.root_module.resources
    group.type == "aws_iam_group"

    some group_membership in input.configuration.root_module.resources
    group_membership.type == "aws_iam_group_membership"
    user1.address in group_membership.expressions.users.references
    user2.address in group_membership.expressions.users.references
    group.address in group_membership.expressions.group.references
}
Task: Make a basic AWS IAM group example with an example group policy attachment resource attaching a policy to it

Specification:
Has one "aws_iam_group" resource
with one "name" with any value

Has one "aws_iam_policy" resource
with one "policy" with any value

Has one "aws_iam_group_policy_attachment" resource
with one "group" with the group resource name
with one "policy_arn" with the policy resource arn

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_group" "group" {
  name = "test-group"
}

data "aws_iam_policy_document" "example" {
  statement {
    effect = "Allow"
    actions = [
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeVpcs"
    ]
    resources = [
      "*"
    ]
  }
}

resource "aws_iam_policy" "policy" {
  name        = "test-policy"
  description = "A test policy"
  policy      = data.aws_iam_policy_document.example.json
}

resource "aws_iam_group_policy_attachment" "test-attach" {
  group      = aws_iam_group.group.name
  policy_arn = aws_iam_policy.policy.arn
}

Validation policy (checks.rego):
package iam_group_policy_attachment

import future.keywords.in

default valid := false

valid {
	some group_attachment in input.configuration.root_module.resources
	group_attachment.type == "aws_iam_group_policy_attachment"

	some group in input.configuration.root_module.resources
	group.type == "aws_iam_group"
	group.address in group_attachment.expressions.group.references

	some policy in input.configuration.root_module.resources
	policy.type == "aws_iam_policy"
	policy.address in group_attachment.expressions.policy_arn.references
}
Task: Create a basic AWS IAM user with a basic SSH key attached.

Specification:
Has one "aws_iam_user" resource
with one "name" with any value

Has one "aws_iam_user_ssh_key" resource
with one "username" with value "aws_iam_user.{USER NAME}.name"
with one "encoding" with value "SSH"
with one "public_key" with any value

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_user" "user" {
  name = "test-user"
  path = "/"
}

resource "aws_iam_user_ssh_key" "user" {
  username   = aws_iam_user.user.name
  encoding   = "SSH"
  public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD3F6tyPEFEzV0LX3X8BsXdMsQz1x2cEikKDEY0aIj41qgxMCP/iteneqXSIFZBp5vizPvaoIR3Um9xK7PGoW8giupGn+EPuxIA4cDM4vzOqOkiMPhz5XK0whEjkVzTo4+S0puvDZuwIsdiW9mxhJc7tgBNL0cYlWSYVkz4G/fslNfRPW5mYAM49f4fhtxPb5ok4Q2Lg9dPKVHO/Bgeu5woMc7RY0p1ej6D4CKFE6lymSDJpW0YHX/wqE9+cfEauh7xZcG0q9t2ta6F6fmX0agvpFyZo8aFbXeUBr7osSCJNgvavWbM/06niWrOvYX2xwWdhXmXSrbX8ZbabVohBK41 mytest@mydomain.com"
}

Validation policy (checks.rego):
package iam_user_ssh
import future.keywords.in

default valid := false

valid {
    some user_ssh_resource in input.configuration.root_module.resources
    user_ssh_resource.type == "aws_iam_user_ssh_key"

    some user_resource in input.configuration.root_module.resources
    user_resource.type == "aws_iam_user"
    user_resource.address in user_ssh_resource.expressions.username.references
}
Task: Create a basic AWS IAM group example

Specification:
Has one "aws_iam_group" resource
with one "name" with any value

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_group" "group" {
  name = "my-group"
  path = "/users/"
}

Validation policy (checks.rego):
package iam_group_basic
import future.keywords.in

default valid := false

valid {
    some group_resource in input.configuration.root_module.resources
    group_resource.type == "aws_iam_group"
}
Task: Create a basic AWS IAM user example

Specification:
Has one "aws_iam_user" resource
with one "name" with any value

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_user" "lb" {
  name = "loadbalancer"
  path = "/system/"

  tags = {
    tag-key = "tag-value"
  }
}

Validation policy (checks.rego):
package iam_user_basic
import future.keywords.in

default valid := false

valid {
	some user_resource in input.configuration.root_module.resources
	user_resource.type == "aws_iam_user"
}
Task: Create a basic AWS IAM Virtual MFA Device resource

Specification:
Has one "aws_iam_virtual_mfa_device" resource
with one "virtual_mfa_device_name" with any string

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_virtual_mfa_device" "example" {
  virtual_mfa_device_name = "example"
}

Validation policy (checks.rego):
package iam_mfa_basic
import future.keywords.in

default valid := false

valid {
	some mfa in input.configuration.root_module.resources
	mfa.type == "aws_iam_virtual_mfa_device"
}