Task: Configure a valid Route 53 zone association resource

Specification:
Has multiple "aws_vpc" resource
    with a specified "cidr_block"
    with "enable_dns_hostnames" equal to "true"
    with "enable_dns_support" equal to "true"

Has one "aws_route53_zone" resource
    with "name"
    with a "vpc" block that contains "vpc_id" that references the "aws_vpc" resource

Has one "aws_route53_vpc_association_authorization" resource
    with "vpc_id" referencing the "aws_vpc" resource 
    with "zone_id" referencing the "aws_route53_zone" resource

Has one "aws_route53_zone_association" resource
    with "vpc_id" referencing the "aws_route53_vpc_association_authorization" resource 
    with "zone_id" referencing the "aws_route53_vpc_association_authorization" resource


Terraform configuration (main.tf):
provider "aws" {
    region = "us-east-1"
}

resource "aws_vpc" "example" {
  cidr_block           = "10.6.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
}

resource "aws_route53_zone" "example" {
  name = "example.com"

  vpc {
    vpc_id = aws_vpc.example.id
  }
}

resource "aws_vpc" "alternate" {
  cidr_block           = "10.7.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
}

resource "aws_route53_vpc_association_authorization" "example" {
  vpc_id  = aws_vpc.alternate.id
  zone_id = aws_route53_zone.example.id
}

resource "aws_route53_zone_association" "example" {
  vpc_id  = aws_route53_vpc_association_authorization.example.vpc_id
  zone_id = aws_route53_vpc_association_authorization.example.zone_id
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_r53_zone = false

default is_valid_vpc = false

default is_valid_zone_association = false

default is_valid_vpc_association = false

# Validate aws_route53_zone resource
is_valid_r53_zone {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_zone"
    resource.expressions.vpc[0].vpc_id.references[0]
    resource.expressions.name
}

is_valid_vpc {
    some i, j
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_vpc"
    resource.expressions.cidr_block
    resource.expressions.enable_dns_hostnames.constant_value == true
    resource.expressions.enable_dns_support.constant_value == true
    
    resource2 := input.configuration.root_module.resources[j]
    resource2.type == "aws_vpc"
    resource2.expressions.cidr_block
    resource2.expressions.enable_dns_hostnames.constant_value == true
    resource2.expressions.enable_dns_support.constant_value == true
}

is_valid_zone_association {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_zone_association"
    resource.expressions.vpc_id.references[0]
    resource.expressions.zone_id.references[0]
}

is_valid_vpc_association {
     some i
     resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_vpc_association_authorization"
    resource.expressions.vpc_id.references[0]
    resource.expressions.zone_id.references[0]
}

# Combine all checks into a final rule
is_configuration_valid {
    is_valid_r53_zone
    is_valid_vpc
    is_valid_zone_association
    is_valid_vpc_association
}