Task: Generate Terraform code to set up an AWS IAM role named 'eks-cluster' for an Amazon EKS cluster. Ensure the role's assume role policy allows access for EKS services and attach the AmazonEKSClusterPolicy to this role. Create an AWS EKS cluster with a name and version, attaching it to a subnet and VPC from us-east-1. Ensure proper dependency handling for the IAM role's policy attachment during EKS cluster creation. The EKS cluster's endpoint private access should be set to false, and endpoint public access set to true

Specification:
has one "aws_iam_role" 
with one "name"
with one "assume_role_policy"

has one "aws_iam_role_policy_attachment"
with one "policy_arn"
with one "role" referencing the "aws_iam_role.eks.name"

has one "aws_eks_cluster"
with one "name"
with one "version"
with one "role_arn"
with one "vpc_config" containing "endpoint_private_access", "endpoint_public_access", and "subnet_ids"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "private-us-east-1a" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_subnet" "public-us-east-1a" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.2.0/24"
}

resource "aws_iam_role" "example" {
  name = "eks-cluster"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example.name
}

resource "aws_eks_cluster" "cluster" {
  name     = "test"
  version  = "1.22"
  role_arn = aws_iam_role.example.arn

  vpc_config {

    endpoint_private_access = false
    endpoint_public_access  = true
    public_access_cidrs     = ["0.0.0.0/0"]

    subnet_ids = [
      aws_subnet.private-us-east-1a.id,
      aws_subnet.public-us-east-1a.id,
    ]
  }

  depends_on = [aws_iam_role_policy_attachment.eks_cluster_policy,
                aws_iam_role_policy_attachment.eks_service_policy]
}

Validation policy (checks.rego):
package terraform.analysis

default has_aws_iam_role = false
default has_aws_iam_role_policy_attachment = false
default has_aws_eks_cluster = false

has_aws_iam_role {
    role := input.configuration.root_module.resources[_]
    role.type == "aws_iam_role"
    role.expressions.assume_role_policy
}

has_aws_iam_role_policy_attachment {
    policy_attachment := input.configuration.root_module.resources[_]
    policy_attachment.type == "aws_iam_role_policy_attachment"
    policy_attachment.expressions.policy_arn.constant_value == "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
    policy_attachment.expressions.role 
}

has_aws_eks_cluster {
    cluster := input.configuration.root_module.resources[_]
    cluster.type = "aws_eks_cluster"
    cluster.expressions.name 
    cluster.expressions.version 
    cluster.expressions.role_arn
    cluster.expressions.vpc_config[_].endpoint_private_access.constant_value == false
    cluster.expressions.vpc_config[_].endpoint_public_access.constant_value == true
    cluster.expressions.vpc_config[_].subnet_ids
    count(cluster.expressions.vpc_config[_].subnet_ids.references) >= 4
}

valid_config {
    has_aws_iam_role
    has_aws_iam_role_policy_attachment
    has_aws_eks_cluster
}