Task: Generate a Terraform script to create an AWS EKS Fargate profile. Define a resource that links to an EKS cluster (with name set to "example") by name, sets a Fargate profile name, and assigns a pod execution role ARN (tied to an IAM role with name "example"). Specify subnet IDs and include a selector for the namespace 'example'.

Specification:
has one "aws_eks_fargate_profile" resource
with one "cluster_name"
with one "fargate_profile_name"
with one "pod_execution_role_arn"
with one "subnet_ids"
with one "selector" containing "namespace"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example1" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_subnet" "example2" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.2.0/24"
}

resource "aws_iam_role" "example" {
  name = "eks-cluster-1"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role" "example-fargate" {
  name = "eks-fargate-profile-example"

  assume_role_policy = jsonencode({
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "eks-fargate-pods.amazonaws.com"
      }
    }]
    Version = "2012-10-17"
  })
}

resource "aws_iam_role_policy_attachment" "example-AmazonEKSFargatePodExecutionRolePolicy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
  role       = aws_iam_role.example-fargate.name
}

resource "aws_eks_cluster" "example" {
  name     = "example"
  role_arn = aws_iam_role.example.arn

  vpc_config {
    subnet_ids = [aws_subnet.example1.id, aws_subnet.example2.id]
  }
}

resource "aws_eks_fargate_profile" "example" {
  cluster_name           = aws_eks_cluster.example.name
  fargate_profile_name   = "example"
  pod_execution_role_arn = aws_iam_role.example-fargate.arn
  subnet_ids             = [aws_subnet.example1.id, aws_subnet.example2.id]

  selector {
    namespace = "example"
  }
}

Validation policy (checks.rego):
package terraform.validation

default has_aws_eks_fargate_profile_example = false

has_aws_eks_fargate_profile_example {
    fargate_profile := input.configuration.root_module.resources[_]
    fargate_profile.type == "aws_eks_fargate_profile"
    fargate_profile.name == "example"
    contains(fargate_profile.expressions.cluster_name.references[_], "aws_eks_cluster.example")  # Ensures it references aws_eks_cluster.example correctly
    fargate_profile.expressions.fargate_profile_name.constant_value == "example"
    contains(fargate_profile.expressions.pod_execution_role_arn.references[_], "aws_iam_role.example")  # Ensures it references aws_iam_role.example correctly
    count(fargate_profile.expressions.subnet_ids.references) > 0  # Ensure that subnet_ids is populated
    fargate_profile.expressions.selector[_].namespace.constant_value == "example"
}