znyang/ambig-iac huggingface dataset:
Task: Generate a basic Amazon Kinesis Analytics Application with an input kinesis stream

Specification:
Has one "aws_kinesis_analytics_application" resource with one "aws_kinesis_stream" resource as an input

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region  = "us-east-1"
}


data "aws_iam_policy_document" "StreamReaderWriter" {
  statement {
    effect = "Allow"
    actions = ["kinesis:DescribeStream",
               "kinesis:GetShardIterator",
               "kinesis:GetRecords"]
    resources = [aws_kinesis_stream.test_stream.arn]
  }
}

data "aws_iam_policy_document" "KinesisAssume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["kinesisanalytics.amazonaws.com"]
    }
  }
}

resource "aws_iam_policy" "StreamReaderWriter" {
  name   = "KinesisStreamReaderWriter"
  policy = data.aws_iam_policy_document.StreamReaderWriter.json
}

resource "aws_iam_role" "kinesis_role" {
  name               = "kinesis_role"
  assume_role_policy = data.aws_iam_policy_document.KinesisAssume.json
}

resource "aws_iam_role_policy_attachment" "attach_kinesis_role" {
  role       = aws_iam_role.kinesis_role.name
  policy_arn = aws_iam_policy.StreamReaderWriter.arn
}

resource "aws_kinesis_stream" "test_stream" {
  name             = "events"
  shard_count      = 1
  retention_period = 168
}


resource "aws_kinesis_analytics_application" "test_application" {
  name = "kinesis-analytics-application-test"

  inputs {
    name_prefix = "test_prefix"

    kinesis_stream {
      resource_arn = aws_kinesis_stream.test_stream.arn
      role_arn     = aws_iam_role.kinesis_role.arn
    }

    parallelism {
      count = 1
    }

    schema {
      record_columns {
        mapping  = "$.test"
        name     = "test"
        sql_type = "VARCHAR(8)"
      }

      record_encoding = "UTF-8"

      record_format {
        mapping_parameters {
          json {
            record_row_path = "$"
          }
        }
      }
    }
  }
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

has_valid_iam_role(resources) { 
        some resource in resources 
    resource.type == "aws_iam_role" 
    contains(resource.change.after.assume_role_policy,"kinesisanalytics.amazonaws.com") 
}

has_valid_kinesis_stream {
        some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesis_stream"
    resource.values.name
}

has_valid_kinesis_analytics_application {
        some i
        resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesis_analytics_application"
    resource.values.name
    resource.values.inputs[_].kinesis_stream
}

has_valid_resources {
        has_valid_iam_role(input.resource_changes)
        has_valid_kinesis_stream
    has_valid_kinesis_analytics_application
}
Task: Generate a basic Amazon Kinesis V2 Analytics Application to manage an Apache Flink Application

Specification:
Has one "aws_iam_role" resource, and one "aws_kinesisanalyticsv2_application" with argument runtime_environment != "SQL-1_0"

Terraform configuration (main.tf):
provider "aws" {
  region = "us-west-2"
}

data "aws_iam_policy_document" "KinesisAssume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["kinesisanalytics.amazonaws.com"]
    }
  }
}


resource "aws_iam_role" "kinesis_role" {
  name               = "kinesis_role"
  assume_role_policy = data.aws_iam_policy_document.KinesisAssume.json
}

resource "aws_kinesisanalyticsv2_application" "flink_app" {
  name                 = "example-application1"
  runtime_environment  = "FLINK-1_13"
  service_execution_role = aws_iam_role.kinesis_role.arn
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

has_valid_iam_role(resources) { 
        some resource in resources 
    resource.type == "aws_iam_role" 
    contains(resource.change.after.assume_role_policy,"kinesisanalytics.amazonaws.com") 
}


has_valid_kinesisanalyticsv2_application {
        some i
        resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesisanalyticsv2_application"
    resource.values.name
    resource.values.runtime_environment != "SQL-1_0"
           role := input.configuration.root_module.resources[i]
    role.expressions.service_execution_role
}

has_valid_resources {
        has_valid_iam_role(input.resource_changes)
    has_valid_kinesisanalyticsv2_application
}
Task: Generate a Kinesis Firehose Delivery Stream with a Splunk destination

Specification:
Has one "aws_iam_role" resource, one "aws_s3_bucket" resource, and one "aws_kinesis_firehose_delivery_stream" resource with an "splunk_configuration" block

Terraform configuration (main.tf):
provider "aws" {
  region = "us-west-2"
}

data "aws_iam_policy_document" "firehose_assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["firehose.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "firehose_role" {
  name               = "firehose_test_role"
  assume_role_policy = data.aws_iam_policy_document.firehose_assume_role.json
}

resource "aws_s3_bucket" "januaryfifth" {
  bucket = "januaryfifth"
}

resource "aws_kinesis_firehose_delivery_stream" "test_stream" {
  name        = "terraform-kinesis-firehose-test-stream"
  destination = "splunk"

  splunk_configuration {
    hec_endpoint               = "https://http-inputs-mydomain.splunkcloud.com:443"
    hec_token                  = "51D4DA16-C61B-4F5F-8EC7-ED4301342A4A"
    hec_acknowledgment_timeout = 600
    hec_endpoint_type          = "Event"
    s3_backup_mode             = "FailedEventsOnly"

    s3_configuration {
      role_arn           = aws_iam_role.firehose_role.arn
      bucket_arn         = aws_s3_bucket.januaryfifth.arn
      buffering_size     = 10
      buffering_interval = 400
      compression_format = "GZIP"
    }
  }
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

has_valid_iam_role(resources) { 
	some resource in resources 
    resource.type == "aws_iam_role" 
    contains(resource.change.after.assume_role_policy,"firehose.amazonaws.com") 
}

has_valid_bucket {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_s3_bucket"
}

has_valid_firehose_delivery_stream {
	some i
	resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesis_firehose_delivery_stream"
    resource.values.name
    resource.values.destination == "splunk"
    resource.values.splunk_configuration[_].s3_configuration
	role := input.configuration.root_module.resources[i]
    role.expressions.splunk_configuration[_].s3_configuration[_].bucket_arn
    role.expressions.splunk_configuration[_].s3_configuration[_].role_arn
}

has_valid_resources {
	has_valid_iam_role(input.resource_changes)
	has_valid_bucket
    has_valid_firehose_delivery_stream
}
Task: Generate a basic Kinesis Video Stream resource

Specification:
Has one "aws_kinesis_video_stream" resource

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_kinesis_video_stream" "default" {
  name                    = "terraform-kinesis-video-stream"
  data_retention_in_hours = 1
  device_name             = "kinesis-video-device-name"
  media_type              = "video/h264"

  tags = {
    Name = "terraform-kinesis-video-stream"
  }
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

has_valid_kinesis_video_stream {
	some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesis_video_stream"
    resource.values.name
}

has_valid_resources {
	has_valid_kinesis_video_stream
}
Task: Generate a resource to manage a Kinesis Stream Consumer

Specification:
Has one "aws_kinesis_stream" resource and one "aws_kinesis_stream_consumer" resource

Terraform configuration (main.tf):
provider "aws" {
  region = "us-west-2"
}

resource "aws_kinesis_stream" "example" {
  name        = "example-stream"
  shard_count = 1
}

resource "aws_kinesis_stream_consumer" "example" {
  name       = "example-consumer"
  stream_arn = aws_kinesis_stream.example.arn
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false


has_valid_kinesis_stream {
	some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesis_stream"
    resource.values.name
}

has_valid_kinesis_stream_consumer {
	some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesis_stream_consumer"
    resource.values.name
    role := input.configuration.root_module.resources[i]
    role.expressions.stream_arn
}

has_valid_resources {
	has_valid_kinesis_stream
    has_valid_kinesis_stream_consumer
}
Task: Generate a Kinesis Firehose Delivery Stream with an extended S3 Destination

Specification:
Has one "aws_iam_role" resource, one "aws_s3_bucket" resource, and one "aws_kinesis_firehose_delivery_stream" resource with an "extended_s3_configuration" block 


Terraform configuration (main.tf):
provider "aws" {
  region = "us-west-2"
}

resource "aws_s3_bucket" "januarysixteenth" {
  bucket = "januarysixteenth"
}

data "aws_iam_policy_document" "firehose_assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["firehose.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "firehose_role" {
  name               = "firehose_test_role"
  assume_role_policy = data.aws_iam_policy_document.firehose_assume_role.json
}

resource "aws_kinesis_firehose_delivery_stream" "extended_s3_stream" {
  name        = "terraform-kinesis-firehose-extended-s3-test-stream"
  destination = "extended_s3"

  extended_s3_configuration {
    role_arn   = aws_iam_role.firehose_role.arn
    bucket_arn = aws_s3_bucket.januarysixteenth.arn
  }
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

has_valid_iam_role(resources) { 
        some resource in resources 
    resource.type == "aws_iam_role" 
    contains(resource.change.after.assume_role_policy,"firehose.amazonaws.com") 
}

has_valid_bucket {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_s3_bucket"
}

has_valid_firehose_delivery_stream {
        some i
        resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesis_firehose_delivery_stream"
    resource.values.name
    resource.values.destination == "extended_s3"
    resource.values.extended_s3_configuration[_]
        role := input.configuration.root_module.resources[i]
    role.expressions.extended_s3_configuration[_].role_arn
}

has_valid_resources {
        has_valid_iam_role(input.resource_changes)
        has_valid_bucket
    has_valid_firehose_delivery_stream
}
Task: Generate a basic Amazon Kinesis Analytics Application

Specification:
Has one "aws_kinesis_analytics_application" resource

Terraform configuration (main.tf):
provider "aws" {
  region = "us-west-2"
}

resource "aws_kinesis_analytics_application" "test_application" {
  name = "kinesis-analytics-application-test"
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

has_valid_kinesis_analytics_application {
        some i
        resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesis_analytics_application"
    resource.values.name
}

has_valid_resources {
    has_valid_kinesis_analytics_application
}
Task: Generate a basic Amazon Kinesis V2 Analytics Application to manage a SQL application

Specification:
Has one "aws_iam_role" resource, and one "aws_kinesisanalyticsv2_application" with argument runtime_environment == "SQL-1_0"

Terraform configuration (main.tf):
provider "aws" {
  region = "us-west-2"
}

data "aws_iam_policy_document" "KinesisAssume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["kinesisanalytics.amazonaws.com"]
    }
  }
}


resource "aws_iam_role" "kinesis_role" {
  name               = "kinesis_role"
  assume_role_policy = data.aws_iam_policy_document.KinesisAssume.json
}

resource "aws_kinesisanalyticsv2_application" "flink_app" {
  name                 = "example-application1"
  runtime_environment  = "SQL-1_0"
  service_execution_role = aws_iam_role.kinesis_role.arn
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

has_valid_iam_role(resources) { 
	some resource in resources 
    resource.type == "aws_iam_role" 
    contains(resource.change.after.assume_role_policy,"kinesisanalytics.amazonaws.com") 
}


has_valid_kinesisanalyticsv2_application {
	some i
	resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kinesisanalyticsv2_application"
    resource.values.name
    resource.values.runtime_environment == "SQL-1_0"
   	role := input.configuration.root_module.resources[i]
    role.expressions.service_execution_role
}

has_valid_resources {
	has_valid_iam_role(input.resource_changes)
    has_valid_kinesisanalyticsv2_application
}
Task: Generate a Kendra data source resource with a proxy configuration

Specification:
Has one "aws_iam_role" resource, one "aws_kendra_index" resource, and one "aws_kendra_data_source" resource with a "proxy_configuration" block

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region  = "us-east-1"
}

resource "aws_iam_role" "role" {
  name = "Kendra-Role"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "kendra.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_role_policy" "policy" {
  name = "Kendra-Policy"
  role = aws_iam_role.role.id

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_kendra_index" "example" {
  name        = "example"
  description = "example"
  edition     = "DEVELOPER_EDITION"
  role_arn    = aws_iam_role.role.arn
}

resource "aws_kendra_data_source" "example" {
  index_id = aws_kendra_index.example.id
  name     = "example"
  type     = "WEBCRAWLER"
  role_arn = aws_iam_role.role.arn

  configuration {
    web_crawler_configuration {
      proxy_configuration {
        host        = "a.example.com"
        port        = "443"
      }

      urls {
        seed_url_configuration {
          seed_urls = [
            "https://docs.aws.amazon.com/codedeploy/latest/userguide/getting-started-create-service-role.html"
          ]
        }
      }
    }
  }
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

has_valid_iam_role(resources) { 
    some resource in resources 
    resource.type == "aws_iam_role" 
    contains(resource.change.after.assume_role_policy,"kendra.amazonaws.com") 
}

has_valid_kendra_index {
        some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kendra_index"
    resource.values.name
    role := input.configuration.root_module.resources[i]
    role.expressions.role_arn
}

has_valid_kendra_data_source{
        some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kendra_data_source"
    resource.values.name
    resource.values.type
    resource.values.configuration[_].web_crawler_configuration[_].proxy_configuration
    role := input.configuration.root_module.resources[i]
    role.expressions.role_arn
    role.expressions.index_id
}


has_valid_resources {
    has_valid_iam_role(input.resource_changes)
    has_valid_kendra_index
    has_valid_kendra_data_source
}
Task: Generate a Kendra data source resource With URL Exclusion and Inclusion Patterns

Specification:
Has one "aws_iam_role" resource, one "aws_kendra_index" resource, and one "aws_kendra_data_source" resource with "url_exclusion_patterns" and "url_inclusion_patterns"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region  = "us-east-1"
}

resource "aws_iam_role" "role" {
  name = "Kendra-Role"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "kendra.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_role_policy" "policy" {
  name = "Kendra-Policy"
  role = aws_iam_role.role.id

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_kendra_index" "example" {
  name        = "example"
  description = "example"
  edition     = "DEVELOPER_EDITION"
  role_arn    = aws_iam_role.role.arn
}

resource "aws_kendra_data_source" "example" {
  index_id = aws_kendra_index.example.id
  name     = "example"
  type     = "WEBCRAWLER"
  role_arn = aws_iam_role.role.arn

  configuration {
    web_crawler_configuration {
      url_exclusion_patterns = ["example"]
      url_inclusion_patterns = ["hello"]

      urls {
        seed_url_configuration {
          seed_urls = [
            "https://docs.aws.amazon.com/codedeploy/latest/userguide/getting-started-create-service-role.html"
          ]
        }
      }
    }
  }
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

has_valid_iam_role(resources) { 
    some resource in resources 
    resource.type == "aws_iam_role" 
    contains(resource.change.after.assume_role_policy,"kendra.amazonaws.com") 
}

has_valid_kendra_index {
        some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kendra_index"
    resource.values.name
    role := input.configuration.root_module.resources[i]
    role.expressions.role_arn
}

has_valid_kendra_data_source{
        some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kendra_data_source"
    resource.values.name
    resource.values.type
    resource.values.configuration[_].web_crawler_configuration[_].url_exclusion_patterns
    resource.values.configuration[_].web_crawler_configuration[_].url_inclusion_patterns
    role := input.configuration.root_module.resources[i]
    role.expressions.role_arn
    role.expressions.index_id
}


has_valid_resources {
    has_valid_iam_role(input.resource_changes)
    has_valid_kendra_index
    has_valid_kendra_data_source
}
Task: Generate a basic Kendra index resource With user group resolution configuration

Specification:
Has one "aws_iam_role" resource and one "aws_kendra_index" resource with the "user_group_resolution_configuration" block

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region  = "us-east-1"
}

resource "aws_iam_role" "role" {
  name = "Kendra-Role"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "kendra.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_role_policy" "policy" {
  name = "Kendra-Policy"
  role = aws_iam_role.role.id

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_kendra_index" "example" {
  name     = "example"
  role_arn = aws_iam_role.role.arn

  user_group_resolution_configuration {
    user_group_resolution_mode = "AWS_SSO"
  }
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

has_valid_iam_role(resources) { 
    some resource in resources 
    resource.type == "aws_iam_role" 
    contains(resource.change.after.assume_role_policy,"kendra.amazonaws.com") 
}

has_valid_kendra_index {
	some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_kendra_index"
    resource.values.name
    resource.values.user_group_resolution_configuration
    role := input.configuration.root_module.resources[i]
    role.expressions.role_arn
}


has_valid_resources {
    has_valid_iam_role(input.resource_changes)
    has_valid_kendra_index
}
Task: Set up an aws_route_53 zone named "example53.com"

Specification:
Has one "aws_route53_zone" resource
    with "name" set to "example53.com"

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_route53_zone" "primary" {
  name = "example53.com"
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_r53_zone = false


# Validate aws_route53_zone resource
is_valid_r53_zone {
	some i
	resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_zone"
    resource.expressions.name.constant_value == "example53.com"
}


# Combine all checks into a final rule
is_configuration_valid {
    is_valid_r53_zone
}
Task: Set up a non-alias aws_route_53 record that is linked to an aws_route53_zone resource named "example53.com"

Specification:
Has one "aws_route53_zone" resource
    with "name" set to "example53.com"

Has one "aws_route53_record" resource
    with "name"
    with "type"
    with "ttl"
    with "records"
    with "zone_id" referencing the "aws_route53_zone" resource


Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_route53_zone" "example53" {
  name = "example53.com"
}

resource "aws_route53_record" "example53_A" {
  zone_id = aws_route53_zone.example53.zone_id
  name    = "example53.com"
  type    = "A"
  ttl     = "300"
  records = ["192.0.2.1"]  
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_r53_zone = false

default is_valid_r53_record = false

# Validate aws_route53_zone resource
is_valid_r53_zone {
	some i
	resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_zone"
    resource.expressions.name.constant_value == "example53.com"
}

# Validate aws_route53_record
is_valid_r53_record {
	some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_record"
    resource.expressions.name
    resource.expressions.type
    resource.expressions.ttl
    resource.expressions.records
    resource.expressions.zone_id.references[0] == "aws_route53_zone.example53.zone_id"
}


# Combine all checks into a final rule
is_configuration_valid {
    is_valid_r53_zone
    is_valid_r53_record
}