znyang/ambig-iac huggingface dataset:
Task: Create a S3 bucket with an example name

Specification:
Has an aws_s3_bucket resource

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "my-tf-test-bucket"
}

Validation policy (checks.rego):
package aws_bucket
import future.keywords.in

default valid := false

valid {
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"
}
Task: Create an AWS resource to help me store images that I want to display on my website

Specification:
Has an aws_s3_bucket resource

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example-bucket" {
  bucket = "test-bucket"
}

Validation policy (checks.rego):
package aws_s3
import future.keywords.in

default valid := false

valid {
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"
}
Task: Create S3 bucket with bucket name = "mybucket" and attach an acclerate configuration resource for the bucket with enabled status.

Specification:
Has an aws_s3_bucket resource

Has an aws_bucket_accelerate_configuration resource
with bucket = bucked id OR name
with status = "Enabled" (case sensitive)

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "mybucket" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_accelerate_configuration" "example" {
  bucket = aws_s3_bucket.mybucket.id
  status = "Enabled"
}

Validation policy (checks.rego):
package s3_bucket_accelerate
import future.keywords.in

default valid := false

valid {
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"
        bucket.expressions.bucket.constant_value == "mybucket"

        some accelerate_config in input.configuration.root_module.resources
        accelerate_config.type == "aws_s3_bucket_accelerate_configuration"
        bucket.address in accelerate_config.expressions.bucket.references
        accelerate_config.expressions.status.constant_value == "Enabled"
}

valid {
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"
        bucket.expressions.bucket.constant_value == "mybucket"

        some accelerate_config in input.configuration.root_module.resources
        accelerate_config.type == "aws_s3_bucket_accelerate_configuration"
        accelerate_config.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
        accelerate_config.expressions.status.constant_value == "Enabled"
}
Task: Create S3 bucket with bucket name = "mybucket" and set the ownership control of the S3 bucket to be bucket owner preferred.
Then create an ACL resource that depends on ownership control and makes bucket private. Use bucket references, NOT the name of the bucket.

Specification:
Has an aws_s3_bucket resource

Has an aws_s3_bucket_ownership_controls
with bucket = bucket id
and rule with object_ownership = "BucketOwnerPreferred"

Has an aws_s3_bucket_acl

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_ownership_controls" "example" {
  bucket = aws_s3_bucket.example.id
  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}

resource "aws_s3_bucket_acl" "example" {
  depends_on = [aws_s3_bucket_ownership_controls.example]

  bucket = aws_s3_bucket.example.id
  acl    = "private"
}


Validation policy (checks.rego):
package s3_bucket_acl
import future.keywords.in

default valid := false

valid {
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"
    bucket.expressions.bucket.constant_value == "mybucket"
    
    some ownership_controls in input.configuration.root_module.resources
    ownership_controls.type == "aws_s3_bucket_ownership_controls"
    bucket.address in ownership_controls.expressions.bucket.references
    some rule in ownership_controls.expressions.rule
    rule.object_ownership.constant_value == "BucketOwnerPreferred"

    some acl in input.configuration.root_module.resources
    acl.type == "aws_s3_bucket_acl"
    bucket.address in acl.expressions.bucket.references
    acl.expressions.acl.constant_value == "private"
    ownership_controls.address in acl.depends_on
}
Task: Create S3 bucket with bucket name = "mybucket". Add analytics configuration for entire S3 bucket and export results to a second S3 bucket. Use bucket references, NOT the names of the buckets.

Specification:
Has an aws_s3_bucket resource

Has an aws_bucket_analytics_configuration resource
with bucket = bucked id
and storage_class_analysis with (refer to desired output)

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket_analytics_configuration" "example-entire-bucket" {
  bucket = aws_s3_bucket.example.id
  name   = "EntireBucket"

  storage_class_analysis {
    data_export {
      destination {
        s3_bucket_destination {
          bucket_arn = aws_s3_bucket.analytics.arn
        }
      }
    }
  }
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket" "analytics" {
  bucket = "analytics destination"
}

Validation policy (checks.rego):
package s3_bucket_analytics
import future.keywords.in

default valid := false

valid {
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"
        bucket.expressions.bucket.constant_value == "mybucket"

        some other_bucket in input.configuration.root_module.resources
        other_bucket.type == "aws_s3_bucket"
        not bucket == other_bucket

        some analytics in input.configuration.root_module.resources
        analytics.type == "aws_s3_bucket_analytics_configuration"
        bucket.address in analytics.expressions.bucket.references
    some export in analytics.expressions.storage_class_analysis
    some dest in export.data_export
    some bucket_dest in dest.destination
    some arn in bucket_dest.s3_bucket_destination
    other_bucket.address in arn.bucket_arn.references
}
Task: Create S3 bucket with bucket name = "mybucket". Add intelligent tiering configuration resource for the bucket.

Specification:
Has an aws_s3_bucket resource

Has an aws_s3_bucket_intelligent_tiering
with bucket = bucked id OR name
and correct tiering attributes

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket_intelligent_tiering_configuration" "example-entire-bucket" {
  bucket = aws_s3_bucket.example.id
  name   = "EntireBucket"

  tiering {
    access_tier = "DEEP_ARCHIVE_ACCESS"
    days        = 180
  }
  tiering {
    access_tier = "ARCHIVE_ACCESS"
    days        = 125
  }
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

Validation policy (checks.rego):
package s3_bucket_intelligent_tiering
import future.keywords.in

default valid := false

valid {
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"
    bucket.expressions.bucket.constant_value == "mybucket"
    
    some intelligent_tiering in input.configuration.root_module.resources
    intelligent_tiering.type == "aws_s3_bucket_intelligent_tiering_configuration"
    bucket.address in intelligent_tiering.expressions.bucket.references
}

valid {
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"
    bucket.expressions.bucket.constant_value == "mybucket"
    
    some intelligent_tiering in input.configuration.root_module.resources
    intelligent_tiering.type == "aws_s3_bucket_intelligent_tiering_configuration"
    intelligent_tiering.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}
Task: Create S3 bucket with bucket name = "mybucket" and an inventory configuration resource for the bucket that reports daily.

Specification:
Has two resources "aws_s3_bucket"

Has one resource "aws_s3_bucket_inventory"
with bucket = first bucket id OR name
with schedule with frequency = "Daily"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "test" {
  bucket = "mybucket"
}

resource "aws_s3_bucket" "inventory" {
  bucket = "my-tf-inventory-bucket"
}

resource "aws_s3_bucket_inventory" "test" {
  bucket = aws_s3_bucket.test.id
  name   = "EntireBucketDaily"

  included_object_versions = "All"

  schedule {
    frequency = "Daily"
  }

  destination {
    bucket {
      format     = "ORC"
      bucket_arn = aws_s3_bucket.inventory.arn
    }
  }
}

Validation policy (checks.rego):
package s3_bucket_inventory
import future.keywords.in

default valid := false

valid {
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"
    bucket.expressions.bucket.constant_value == "mybucket"
    
    some inventory in input.configuration.root_module.resources
    inventory.type == "aws_s3_bucket_inventory"
    bucket.address in inventory.expressions.bucket.references
    some freq in inventory.expressions.schedule
    freq.frequency.constant_value == "Daily"
}

valid {
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"
    bucket.expressions.bucket.constant_value == "mybucket"
    
    some inventory in input.configuration.root_module.resources
    inventory.type == "aws_s3_bucket_inventory"
    inventory.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
    some freq in inventory.expressions.schedule
    freq.frequency.constant_value == "Daily"
}
Task: Create an AWS S3 bucket and configure a CSV inventory report every week of all current object versions in the bucket and store it in another created bucket.

Specification:
Has two resources "aws_s3_bucket"

Has one resource "aws_s3_bucket_inventory"
with bucket = first bucket id OR name
with schedule with frequency = "Weekly"
with included_object_versions = "Current"
with destination with bucket with format = "CSV" and bucket_arn = other bucket arn



Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "test" {
  bucket = "my-tf-test-bucket"
}

resource "aws_s3_bucket" "inventory" {
  bucket = "my-tf-inventory-bucket"
}

resource "aws_s3_bucket_inventory" "test" {
  bucket = aws_s3_bucket.test.id
  name   = "EntireBucketWeekly"

  included_object_versions = "Current"

  schedule {
    frequency = "Weekly"
  }

  destination {
    bucket {
      format     = "CSV"
      bucket_arn = aws_s3_bucket.inventory.arn
    }
  }
}

Validation policy (checks.rego):
package aws_s3_bucket_inventory
import future.keywords.in

default valid := false

valid { # IF THE SOURCE BUCKET IS REFERRED TO BY ID
        some bucket1 in input.configuration.root_module.resources
        bucket1.type == "aws_s3_bucket"
        
    some bucket2 in input.configuration.root_module.resources
        bucket2.type == "aws_s3_bucket"
    
    not bucket1 == bucket2

        some inventory in input.configuration.root_module.resources
        inventory.type = "aws_s3_bucket_inventory"
        bucket1.address in inventory.expressions.bucket.references
    
    inventory.expressions.included_object_versions.constant_value == "Current"
    
    some schedule in inventory.expressions.schedule
    schedule.frequency.constant_value == "Weekly"
    
    some destination in inventory.expressions.destination
    some dest_bucket in destination.bucket
    bucket2.address in dest_bucket.bucket_arn.references
}

valid { # IF THE SOURCE BUCKET IS REFFERED TO BY NAME
        some bucket1 in input.configuration.root_module.resources
        bucket1.type == "aws_s3_bucket"
        
    some bucket2 in input.configuration.root_module.resources
        bucket2.type == "aws_s3_bucket"
    
    not bucket1 == bucket2

        some inventory in input.configuration.root_module.resources
        inventory.type = "aws_s3_bucket_inventory"
        bucket1.expressions.bucket.constant_value == inventory.expressions.bucket.constant_value
    
    inventory.expressions.included_object_versions.constant_value == "Current"
    
    some schedule in inventory.expressions.schedule
    schedule.frequency.constant_value == "Weekly"
    
    some destination in inventory.expressions.destination
    some dest_bucket in destination.bucket
    bucket2.address in dest_bucket.bucket_arn.references
}
Task: Create an AWS S3 bucket and send a SNS notification whenever a .log object is created in the bucket. Do not include policies required for this.

Specification:
Has one resource "aws_s3_bucket"

Has one resource "aws_sns_topic"

Has one resource "aws_s3_bucket_notification"
with bucket = bucket id OR name
with topic
    with topic arn = sns topic arn 
    and events = ["s3:ObjectCreated:*"]
    and filter_suffix = ".log"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_sns_topic" "topic" {
  name   = "s3-event-notification-topic"
}

resource "aws_s3_bucket" "bucket" {
  bucket = "your-bucket-name"
}

resource "aws_s3_bucket_notification" "bucket_notification" {
  bucket = aws_s3_bucket.bucket.id

  topic {
    topic_arn     = aws_sns_topic.topic.arn
    events        = ["s3:ObjectCreated:*"]
    filter_suffix = ".log"
  }
}

Validation policy (checks.rego):
package aws_s3_bucket_notification
import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"
    
    some sns_topic in input.configuration.root_module.resources
    sns_topic.type == "aws_sns_topic"

    some notification in input.configuration.root_module.resources
    notification.type = "aws_s3_bucket_notification"
    bucket.address in notification.expressions.bucket.references
    some topic in notification.expressions.topic
    some event in topic.events.constant_value
    event == "s3:ObjectCreated:*"
    topic.filter_suffix.constant_value == ".log"
    sns_topic.address in topic.topic_arn.references
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some sns_topic in input.configuration.root_module.resources
    sns_topic.type == "aws_sns_topic"

    some notification in input.configuration.root_module.resources
    notification.type = "aws_s3_bucket_notification"
    bucket.expressions.bucket.constant_value == notification.expressions.bucket.constant_value
    some topic in notification.expressions.topic
    some event in topic.events.constant_value
    event == "s3:ObjectCreated:*"
    topic.filter_suffix.constant_value == ".log"
    sns_topic.address in topic.topic_arn.references
}
Task: Create a S3 bucket with bucket name = "mybucket" and object lock enabled. Then, add an object lock configuration resource for the new bucket.

Specification:
Has an aws_s3_bucket resource
with object_lock_enabled = true

Has an aws_s3_object_lock resource
with bucket = bucket id OR name
and a correct rule

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"

  object_lock_enabled = true
}

resource "aws_s3_bucket_object_lock_configuration" "example" {
  bucket = aws_s3_bucket.example.id

  rule {
    default_retention {
      mode = "COMPLIANCE"
      days = 5
    }
  }
}

Validation policy (checks.rego):
package s3_bucket_object_lock
import future.keywords.in

default valid := false

valid {
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"
        bucket.expressions.bucket.constant_value == "mybucket"
        bucket.expressions.object_lock_enabled.constant_value == true

        some object_lock in input.configuration.root_module.resources
        object_lock.type == "aws_s3_bucket_object_lock_configuration"
        bucket.address in object_lock.expressions.bucket.references
}

valid {
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"
        bucket.expressions.bucket.constant_value == "mybucket"
        bucket.expressions.object_lock_enabled.constant_value == true

        some object_lock in input.configuration.root_module.resources
        object_lock.type == "aws_s3_bucket_object_lock_configuration"
        object_lock.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}
Task: Create an AWS S3 bucket and apply KMS server side encryption that uses a defined KMS key resource.

Specification:
Has one resource "aws_s3_bucket"

Has one resource "aws_kms_key"

Has one resource "aws_s3_bucket_server_side_encryption"
with bucket = bucket id OR name
with rule
    with apply_server_side_encryption_by_default
        with kms_master_key_id = kms key id
        and sse_algorithm = "aws:kms"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_kms_key" "mykey" {
  description             = "This key is used to encrypt bucket objects"
  deletion_window_in_days = 10
}

resource "aws_s3_bucket" "mybucket" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
  bucket = aws_s3_bucket.mybucket.id

  rule {
    apply_server_side_encryption_by_default {
      kms_master_key_id = aws_kms_key.mykey.arn
      sse_algorithm     = "aws:kms"
    }
  }
}

Validation policy (checks.rego):
package aws_s3_bucket_sse
import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"

        some kms_key in input.configuration.root_module.resources
        kms_key.type == "aws_kms_key"

        some sse in input.configuration.root_module.resources
        sse.type = "aws_s3_bucket_server_side_encryption_configuration"
        bucket.address in sse.expressions.bucket.references
        some rule in sse.expressions.rule
        some rule_args in rule.apply_server_side_encryption_by_default
        kms_key.address in rule_args.kms_master_key_id.references
    rule_args.sse_algorithm.constant_value == "aws:kms"
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"

        some kms_key in input.configuration.root_module.resources
        kms_key.type == "aws_kms_key"

        some sse in input.configuration.root_module.resources
        sse.type = "aws_s3_bucket_server_side_encryption_configuration"
        bucket.expressions.bucket.constant_value == sse.expressions.bucket.constant_value
        some rule in sse.expressions.rule
        some rule_args in rule.apply_server_side_encryption_by_default
        kms_key.address in rule_args.kms_master_key_id.references
    rule_args.sse_algorithm.constant_value == "aws:kms"
    
}
Task: Create a S3 bucket and a bucket CORS configuration resource that attaches an example CORS rule to the bucket. Make sure the CORS rule has all of the required attributes.

Specification:
Has an aws_s3_bucket

Has an aws_s3_bucket_cors_configuration

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_cors_configuration" "example" {
  bucket = aws_s3_bucket.example.id

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["PUT", "POST"]
    allowed_origins = ["https://s3-website-test.hashicorp.com"]
    expose_headers  = ["ETag"]
    max_age_seconds = 3000
  }

  cors_rule {
    allowed_methods = ["GET"]
    allowed_origins = ["*"]
  }
}

Validation policy (checks.rego):
package aws_s3_bucket_cors
import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
	some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

	some cors_config in input.configuration.root_module.resources
    cors_config.type == "aws_s3_bucket_cors_configuration"
    
    bucket.address in cors_config.expressions.bucket.references
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
	some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

	some cors_config in input.configuration.root_module.resources
    cors_config.type == "aws_s3_bucket_cors_configuration"
    
	cors_config.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}
Task: Create a S3 bucket with a CORS configuration that allows POSTs and GETs from my website "https://domain.com".

Specification:
Has an aws_s3_bucket

Has an aws_s3_bucket_cors_configuration
with bucket = bucket id OR name
with cors rule {
    allowed_headers = ["*"]
    allowed_methods = ["GET", "POST"]
    allowed_origins = ["https://domain.com"]
  }

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_cors_configuration" "example" {
  bucket = aws_s3_bucket.example.id

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["GET", "POST"]
    allowed_origins = ["https://domain.com"]
  }
}

Validation policy (checks.rego):
package aws_s3_bucket_cors
import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some cors_config in input.configuration.root_module.resources
    cors_config.type == "aws_s3_bucket_cors_configuration"
    some rule in cors_config.expressions.cors_rule
    some method1 in rule.allowed_methods.constant_value
    method1 == "POST"
    some method2 in rule.allowed_methods.constant_value
    method2 == "GET"
    some origin in rule.allowed_origins.constant_value
    origin == "https://domain.com"
    
    bucket.address in cors_config.expressions.bucket.references
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some cors_config in input.configuration.root_module.resources
    cors_config.type == "aws_s3_bucket_cors_configuration"
    some rule in cors_config.expressions.cors_rule
    some method1 in rule.allowed_methods.constant_value
    method1 == "POST"
    some method2 in rule.allowed_methods.constant_value
    method2 == "GET"
    some origin in rule.allowed_origins.constant_value
    origin == "https://domain.com"
    
    cors_config.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}