Task: Create a S3 bucket and a configuration that stores server access logs into a second S3 bucket.

Specification:
Has two aws_s3_bucket

Has an aws_s3_bucket_logging
with bucket = bucket id OR name
with target_bucket = second bucket id OR name
with target_prefix = "log/"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket" "log_bucket" {
  bucket = "mylogbucket"
}

resource "aws_s3_bucket_logging" "example" {
  bucket = aws_s3_bucket.example.id

  target_bucket = aws_s3_bucket.log_bucket.id
  target_prefix = "log/"
}

Validation policy (checks.rego):
package s3_bucket_logging
import future.keywords.in

default valid := false

valid {
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some other_bucket in input.configuration.root_module.resources
    other_bucket.type == "aws_s3_bucket"
    not bucket == other_bucket

    some logging in input.configuration.root_module.resources
    logging.type == "aws_s3_bucket_logging"
    logging.expressions.target_prefix.constant_value == "log/"
    
    bucket.address in logging.expressions.bucket.references
    other_bucket.address in logging.expressions.target_bucket.references
}

valid {
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some other_bucket in input.configuration.root_module.resources
    other_bucket.type == "aws_s3_bucket"
    not bucket == other_bucket

    some logging in input.configuration.root_module.resources
    logging.type == "aws_s3_bucket_logging"
    logging.expressions.target_prefix.constant_value == "log/"
    
    logging.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
    other_bucket.address in logging.expressions.target_bucket.references
}

valid {
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some other_bucket in input.configuration.root_module.resources
    other_bucket.type == "aws_s3_bucket"
    not bucket == other_bucket

    some logging in input.configuration.root_module.resources
    logging.type == "aws_s3_bucket_logging"
    logging.expressions.target_prefix.constant_value == "log/"
    
    bucket.address in logging.expressions.bucket.references
    logging.expressions.target_bucket.constant_value == other_bucket.expressions.bucket.constant_value
}

valid {
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some other_bucket in input.configuration.root_module.resources
    other_bucket.type == "aws_s3_bucket"
    not bucket == other_bucket

    some logging in input.configuration.root_module.resources
    logging.type == "aws_s3_bucket_logging"
    logging.expressions.target_prefix.constant_value == "log/"
    
    logging.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
    logging.expressions.target_bucket.constant_value == other_bucket.expressions.bucket.constant_value
}