znyang/ambig-iac huggingface dataset:
Task: authenticate a elasticache user with passwords

Specification:
requires access string, engine = REDIS, user id and user name, authentication_mode {type= "password", passwords = ["password1", "password2"]}

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~* +@all"
  engine        = "REDIS"

  authentication_mode {
    type      = "password"
    passwords = ["password1", "password2"]
  }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_elasticache_user_valid(resources) {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.authentication_mode[_].type == "password"
}

# Aggregate all checks
allow {
    aws_elasticache_user_valid(input.resource_changes)
}
Task: Enable contributor insights on a table named "ExampleTableName"

Specification:
Create a DynamoDB table and enable contributor insights

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_dynamodb_contributor_insights" "test" {
  table_name = "ExampleTableName"
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if AWS DynamoDB Contributor Insights is being created for a specific table
aws_dynamodb_contributor_insights_valid(resources) {
    some resource in resources
    resource.type == "aws_dynamodb_contributor_insights"
}

# Aggregate all checks
allow {
    aws_dynamodb_contributor_insights_valid(input.resource_changes)
}
Task: Create a cluster with dax.r4.large and replication factor = 1.

Specification:
require a cluster name, iam_role_arn, node_type, replication factor

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_role" "example" {
  name = "redshift_role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = "sts:AssumeRole",
        Effect = "Allow",
        Principal = {
          Service = "redshift.amazonaws.com"
        },
      },
    ],
  })
}

resource "aws_dax_cluster" "bar" {
  cluster_name       = "cluster-example"
  iam_role_arn       = aws_iam_role.example.arn
  node_type          = "dax.r4.large"
  replication_factor = 1
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dax_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_dax_cluster"
    resource.change.after.node_type == "dax.r4.large"
    resource.change.after.replication_factor == 1
}

# Aggregate all checks
allow {
    aws_dax_cluster_valid(input.resource_changes)
}
Task: Create a serverless MSK with 3 broker nodes.

Specification:
Has one "aws_msk_serverless_cluster" resource
with one "vpc_config"
with one "subnet_ids" with 6 references (3 subnets)

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "vpc" {
    cidr_block = "192.168.0.0/22"
    enable_dns_support = true
    enable_dns_hostnames = true
}

data "aws_availability_zones" "azs" {
    state = "available"
}

resource "aws_subnet" "subnet_az1" {
    availability_zone = data.aws_availability_zones.azs.names[0]
    cidr_block = "192.168.0.0/24"
    vpc_id = aws_vpc.vpc.id
    map_public_ip_on_launch = true
}

resource "aws_subnet" "subnet_az2" {
    availability_zone = data.aws_availability_zones.azs.names[1]
    cidr_block = "192.168.1.0/24"
    vpc_id = aws_vpc.vpc.id
    map_public_ip_on_launch = true
}

resource "aws_subnet" "subnet_az3" {
    availability_zone = data.aws_availability_zones.azs.names[2]
    cidr_block = "192.168.2.0/24"
    vpc_id = aws_vpc.vpc.id
    map_public_ip_on_launch = true
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.vpc.id
}

resource "aws_route_table" "main" {
  vpc_id = aws_vpc.vpc.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
}

resource "aws_route_table_association" "first" {
  subnet_id      = aws_subnet.subnet_az1.id
  route_table_id = aws_route_table.main.id
}

resource "aws_route_table_association" "second" {
  subnet_id      = aws_subnet.subnet_az2.id
  route_table_id = aws_route_table.main.id
}

resource "aws_route_table_association" "third" {
  subnet_id      = aws_subnet.subnet_az3.id
  route_table_id = aws_route_table.main.id
}

resource "aws_security_group" "sg" {
    vpc_id = aws_vpc.vpc.id
}

resource "aws_vpc_security_group_ingress_rule" "ingress1" {
  security_group_id = aws_security_group.sg.id
  cidr_ipv4 = "0.0.0.0/0"
  ip_protocol = "-1"
}

resource "aws_vpc_security_group_egress_rule" "egress1" {
  security_group_id = aws_security_group.sg.id
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "-1"
}

resource "aws_msk_serverless_cluster" "example" {
    cluster_name = "Example"

    vpc_config {
        subnet_ids = [aws_subnet.subnet_az1.id, aws_subnet.subnet_az2.id, aws_subnet.subnet_az3.id]
        security_group_ids = [aws_security_group.sg.id]
    }

    client_authentication {
        sasl {
            iam {
                enabled = true
            }
        }
    }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if MSK cluster is serverless
is_serverless(resource) {
resource.type == "aws_msk_serverless_cluster"
}


# Check if cluster spans three AZs
has_three_azs(resource) {
resource.type == "aws_msk_serverless_cluster"
count(resource.expressions.vpc_config[_].subnet_ids.references) == 6
}

# Main rule combining all checks
allow {
some resource in input.configuration.root_module.resources
is_serverless(resource)
has_three_azs(resource)
}
Task: Create an Aurora MySQL cluster.

Specification:
Has a aws_rds_cluster with engine=="aurora-mysql"

Terraform configuration (main.tf):
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}

resource "aws_rds_cluster" "default" {
cluster_identifier = "aurora-cluster-demo"
engine = "aurora-mysql"
availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
database_name = "mydb"
master_username = "USERNAME"
master_password = "PASSWORD"
backup_retention_period = 5
preferred_backup_window = "07:00-09:00"
skip_final_snapshot = true
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check for Aurora MySQL RDS cluster creation
rds_cluster_created(resources) {
some resource in resources
resource.type == "aws_rds_cluster"
resource.change.actions[_] == "create"
}

# Check if the RDS cluster engine is Aurora MySQL
rds_cluster_engine_valid(resource) {
resource.type == "aws_rds_cluster"
resource.change.after.engine == "aurora-mysql"
}

# Aggregate checks for Aurora MySQL RDS
allow {
# RDS Cluster Checks
rds_cluster_created(input.resource_changes)
some resource in input.resource_changes
rds_cluster_engine_valid(resource)
}
Task: Create an Aurora PostgresQL cluster

Specification:
Has a aws_rds_cluster with engine=="aurora-postgresql"

Terraform configuration (main.tf):
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}

resource "aws_rds_cluster" "default" {
cluster_identifier = "aurora-cluster-demo"
engine = "aurora-postgresql"
availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
database_name = "mydb"
master_username = "USERNAME"
master_password = "PASSWORD"
backup_retention_period = 5
preferred_backup_window = "07:00-09:00"
skip_final_snapshot = true
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check for Aurora MySQL RDS cluster creation
rds_cluster_created(resources) {
some resource in resources
resource.type == "aws_rds_cluster"
resource.change.actions[_] == "create"
}

# Check if the RDS cluster engine is Aurora MySQL
rds_cluster_engine_valid(resource) {
resource.type == "aws_rds_cluster"
resource.change.after.engine == "aurora-postgresql"
}

# Aggregate checks for Aurora MySQL RDS
allow {
# RDS Cluster Checks
rds_cluster_created(input.resource_changes)
some resource in input.resource_changes
rds_cluster_engine_valid(resource)
}
Task: Create an mySQL cluster with 100 GB allocated to each zone.

Specification:
Has one "aws_rds_cluster" resource
with one "allocated_storage" = 100

Terraform configuration (main.tf):
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}

resource "aws_rds_cluster" "example" {
cluster_identifier = "example"
availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
engine = "mysql"
db_cluster_instance_class = "db.r6gd.large"
storage_type = "io1"
allocated_storage = 100
iops = 1000
master_username = "test"
master_password = "mustbeeightcharaters"
skip_final_snapshot = true
}


Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check for RDS cluster creation
rds_cluster_created(resources) {
some resource in resources
resource.type == "aws_rds_cluster"
resource.change.actions[_] == "create"
}

# Check if storage per AZ is at least 1000 GB
storage_per_az_valid(resource) {
resource.type == "aws_rds_cluster"
resource.change.after.allocated_storage == 100
}

# Aggregate checks for RDS cluster
allow {
rds_cluster_created(input.resource_changes)
some resource in input.resource_changes
storage_per_az_valid(resource)
}
Task: Create an mySQL cluster with 100 GB allocated to us-east-1a, us-east-1b, us-east-1c.

Specification:
Has one "aws_rds_cluster" resource
with one "allocated_storage" = 100
with one "availability_zones" = ["us-east-1a", "us-east-1b", "us-east-1c"]
with one "engine" = "mysql"

Terraform configuration (main.tf):
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}

resource "aws_rds_cluster" "example" {
cluster_identifier = "example"
availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
engine = "mysql"
db_cluster_instance_class = "db.r6gd.large"
storage_type = "io1"
allocated_storage = 100
iops = 1000
master_username = "test"
master_password = "mustbeeightcharaters"
skip_final_snapshot = true
}


Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Required AZs
required_azs := ["us-east-1a", "us-east-1b", "us-east-1c"]

# Check for RDS cluster creation
rds_cluster_created(resources) {
some resource in resources
resource.type == "aws_rds_cluster"
resource.change.actions[_] == "create"
}

# Check if engine is MySQL
rds_engine_mysql(resource) {
resource.type == "aws_rds_cluster"
resource.change.after.engine == "mysql"
}

# Check if AZs are correct and storage is 100GB
azs_and_storage_valid(resource) {
resource.type == "aws_rds_cluster"
resource.change.after.availability_zones == required_azs
resource.change.after.allocated_storage == 100
}

# Aggregate checks for RDS cluster
allow {
rds_cluster_created(input.resource_changes)
some resource in input.resource_changes
rds_engine_mysql(resource)
azs_and_storage_valid(resource)
}
Task: Create a mySQL instance.

Specification:
Has one "aws_db_instance" resource
with one "engine" = "mysql"

Terraform configuration (main.tf):
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}

resource "aws_db_instance" "default" {
allocated_storage = 10
db_name = "mydb"
engine = "mysql"
instance_class = "db.t3.micro"
username = "USERNAME"
password = "PASSWORD"
parameter_group_name = "default.mysql5.7"
skip_final_snapshot = true
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check for DB instance creation
db_instance_created(resources) {
some resource in resources
resource.type == "aws_db_instance"
resource.change.actions[_] == "create"
}

# Check if engine is MySQL
db_engine_mysql(resource) {
resource.type == "aws_db_instance"
resource.change.after.engine == "mysql"
}

# Aggregate checks for DB instance
allow {
db_instance_created(input.resource_changes)
some resource in input.resource_changes
db_engine_mysql(resource)
}
Task: Create a PostgresQL instance.

Specification:
Has one "aws_db_instance" resource
with one "engine" = "postgres"

Terraform configuration (main.tf):
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_db_instance" "default" {
allocated_storage = 10
db_name = "mydb"
engine = "postgres"
instance_class = "db.t3.micro"
username = "USERNAME"
password = "PASSWORD"
skip_final_snapshot = true
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check for DB instance creation
db_instance_created(resources) {
some resource in resources
resource.type == "aws_db_instance"
resource.change.actions[_] == "create"
}

# Check if engine is MySQL
db_engine_mysql(resource) {
resource.type == "aws_db_instance"
resource.change.after.engine == "postgres"
}

# Aggregate checks for DB instance
allow {
db_instance_created(input.resource_changes)
some resource in input.resource_changes
db_engine_mysql(resource)
}
Task: Create a DynamoDB table with replicas in us-east-2 and us-west-2

Specification:
Has one "aws_dynamodb_table" resource
with one "replica"
with one "region_name" = "us-east-2"
with one "replica"
with one "region_name" = "us-west-2"

Terraform configuration (main.tf):
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_dynamodb_table" "example" {
name = "example"
hash_key = "TestTableHashKey"
billing_mode = "PAY_PER_REQUEST"
stream_enabled = true
stream_view_type = "NEW_AND_OLD_IMAGES"

attribute {
name = "TestTableHashKey"
type = "S"
}

replica {
region_name = "us-east-2"
}

replica {
region_name = "us-west-2"
}
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Required replica regions
required_regions := {"us-east-2", "us-west-2"}

# Check for DynamoDB table creation
dynamodb_table_created(resources) {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

# Check if replicas match required regions exactly
replicas_valid(resource) {
resource.type == "aws_dynamodb_table"
resource.change.after.replica[0].region_name == "us-east-2"
resource.change.after.replica[1].region_name == "us-west-2"
}

# Aggregate checks for DynamoDB table creation with specific replicas
allow {
dynamodb_table_created(input.resource_changes)
some resource in input.resource_changes
replicas_valid(resource)
}
Task: Create a DynamoDB with point-in-time recovery enabled.

Specification:
Has one "aws_dynamodb_table" resource
with one "point_in_time_recovery"
with one "enabled" = true

Terraform configuration (main.tf):
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

# Configure the AWS Provider
provider "aws" {
region = "us-east-1"
}

resource "aws_dynamodb_table" "example" {
name = "your-dynamodb-table-name"
billing_mode = "PAY_PER_REQUEST" # Or "PROVISIONED" if you prefer provisioned capacity
hash_key = "id"
attribute {
name = "id"
type = "S"
}

point_in_time_recovery {
enabled = true # Set to true to enable point-in-time recovery
}

}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check for DynamoDB table creation
dynamodb_table_created(resources) {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

# Check if point-in-time recovery is enabled
point_in_time_recovery_enabled(resource) {
resource.type == "aws_dynamodb_table"
resource.change.after.point_in_time_recovery[_].enabled == true
}

# Aggregate checks for DynamoDB table with PITR
allow {
dynamodb_table_created(input.resource_changes)
some resource in input.resource_changes
point_in_time_recovery_enabled(resource)
}
Task: Create a DynamoDB table with read and write capacity both set to 10.

Specification:
Has one "aws_dynamodb_table" resource
with one "read_capacity" = 10
with one "write_capacity" = 10

Terraform configuration (main.tf):

provider "aws" {
  region = "us-east-1"
}

terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

resource "aws_dynamodb_table" "basic-dynamodb-table" {
name = "GameScores"
billing_mode = "PROVISIONED"
read_capacity = 10
write_capacity = 10
hash_key = "UserId"
range_key = "GameTitle"

attribute {
name = "UserId"
type = "S"
}

attribute {
name = "GameTitle"
type = "S"
}

tags = {
Name = "dynamodb-table-1"
Environment = "production"
}
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check for DynamoDB table creation
dynamodb_table_created(resources) {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

# Check if read and write capacity are both set to 10
capacity_valid(resource) {
resource.type == "aws_dynamodb_table"
resource.change.after.read_capacity == 10
resource.change.after.write_capacity == 10
}

# Aggregate checks for DynamoDB table creation with specific capacity
allow {
dynamodb_table_created(input.resource_changes)
some resource in input.resource_changes
capacity_valid(resource)
}
Task: Create a DAX cluster.

Specification:
has one "aws_dax_cluster"

Terraform configuration (main.tf):

provider "aws" {
  region = "us-east-1"
}

terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

resource "aws_iam_role" "example" {
name = "test_role"

# Terraform's "jsonencode" function converts a
# Terraform expression result to valid JSON syntax.
assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Sid = ""
Principal = {
Service = "dax.amazonaws.com"
}
},
]
})
}

resource "aws_dax_cluster" "bar" {
cluster_name = "cluster-example"
iam_role_arn = aws_iam_role.example.arn
node_type = "dax.r4.large"
replication_factor = 1
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check for DAX cluster creation
dax_cluster_created(resources) {
some resource in resources
resource.type == "aws_dax_cluster"
resource.change.actions[_] == "create"
}

# Allow DAX cluster creation
allow {
dax_cluster_created(input.resource_changes)
}
Task: Create a DAX parameter group.

Specification:
Has one "aws_dax_parameter_group"

Terraform configuration (main.tf):

provider "aws" {
  region = "us-east-1"
}

terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

resource "aws_dax_parameter_group" "example" {
name = "example"

parameters {
name = "query-ttl-millis"
value = "100000"
}

parameters {
name = "record-ttl-millis"
value = "100000"
}
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check for DAX parameter group creation
dax_parameter_group_created(resources) {
some resource in resources
resource.type == "aws_dax_parameter_group"
resource.change.actions[_] == "create"
}

# Allow DAX parameter group creation with specific parameters
allow {
dax_parameter_group_created(input.resource_changes)
}
Task: Create a DAX subnet group.

Specification:
Has one "aws_dax_subnet_group"

Terraform configuration (main.tf):

provider "aws" {
  region = "us-east-1"
}

terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.0"
}
}
}

resource "aws_vpc" "vpc" {
cidr_block = "192.168.0.0/22"
}


resource "aws_subnet" "example1" {
cidr_block = "192.168.0.0/24"
vpc_id = aws_vpc.vpc.id
}

resource "aws_subnet" "example2" {
cidr_block = "192.168.1.0/24"
vpc_id = aws_vpc.vpc.id
}

resource "aws_dax_subnet_group" "example" {
name = "example"
subnet_ids = [aws_subnet.example1.id, aws_subnet.example2.id]
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check for DAX subnet group creation
dax_subnet_group_created(resources) {
some resource in resources
resource.type == "aws_dax_subnet_group"
resource.change.actions[_] == "create"
}

# Allow DAX subnet group creation with sufficient subnets
allow {
dax_subnet_group_created(input.resource_changes)
}
Task: Enable point-in-time recovery for the DynamoDB table.

Specification:
Has one "aws_dynamodb_table" resource
with one "point_in_time_recovery" with "enabled" = true

Terraform configuration (main.tf):
provider "aws" {
region = "us-east-1" # Change to your desired AWS region
}

resource "aws_dynamodb_table" "example" {
name = "your-dynamodb-table-name"
billing_mode = "PAY_PER_REQUEST" # Or "PROVISIONED" if you prefer provisioned capacity
hash_key = "id"
attribute {
name = "id"
type = "S"
}

point_in_time_recovery {
enabled = true # Set to true to enable point-in-time recovery
}

# Define other table settings as needed
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check for DynamoDB table creation or update
dynamodb_table_modified(resources) {
some resource in resources
resource.type == "aws_dynamodb_table"
resource.change.actions[_] == "create"
}

# Check if point-in-time recovery is enabled
point_in_time_recovery_enabled(resource) {
resource.type == "aws_dynamodb_table"
resource.change.after.point_in_time_recovery[_].enabled == true
}

# Allow if DynamoDB table is modified and point-in-time recovery is enabled
allow {
dynamodb_table_modified(input.resource_changes)
some resource in input.resource_changes
point_in_time_recovery_enabled(resource)
}