Task: Infrastructure for an autograder for a CS class. The autograder needs to run students' code stored on GitHub in a specific environment and store the result. Accomplish this using AWS CodeBuild.

Specification:
have one "aws_codebuild_project" resource
  with "artifacts" argument block
    with "type" argument
    with "location" argument
    with "name" argument
  with "environment" argument block
    with "computer_type" argument
    with "image" argument
    with "type" argument
  with "source" argument block
    with "type" argument with value "GITHUB"
    with "location" argument

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "artifact_bucket" {
  bucket_prefix = "artifact-bucket-"
}

resource "aws_codebuild_project" "autograder_build" {
  name         = "autograder_build"
  service_role = aws_iam_role.autograder_build_role.arn

  artifacts {
    type     = "S3"
    location = aws_s3_bucket.artifact_bucket.arn
    name     = "results.zip" # include this
  }

  environment { # arguments required, exact value not specified
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/standard:7.0-24.10.29"
    type         = "LINUX_CONTAINER"
  }

  source {
    type            = "GITHUB"
    git_clone_depth = 1 # good to have, not required
    location        = "github.com/source-location"
  }
}

resource "aws_iam_role" "autograder_build_role" {
  assume_role_policy = data.aws_iam_policy_document.autograder_build_policy_assume.json
}

data "aws_iam_policy_document" "autograder_build_policy_assume" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["codebuild.amazonaws.com"]
    }
  }

}

data "aws_iam_policy_document" "autograder_build_policy" {
  statement {
    effect = "Allow"
    actions = [
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "ec2:DescribeVpcs"
    ]
    resources = [
      "*"
    ]
  }
}

resource "aws_iam_policy" "autograder_build_policy" {
  name        = "lambda_policy"
  description = "Grants permissions to Lambda to describe vpc, subnet, security group"

  policy = data.aws_iam_policy_document.autograder_build_policy.json
}

resource "aws_iam_role_policy_attachment" "lambda_policy_attach" {
  role       = aws_iam_role.autograder_build_role.name
  policy_arn = aws_iam_policy.autograder_build_policy.arn
}

Validation policy (checks.rego):
package autograder_high

import rego.v1

codebuild_project_valid(codebuild_project) if {
        some artifact in codebuild_project.expressions.artifacts
        artifact.location
        artifact.name
        artifact.type
        some environment in codebuild_project.expressions.environment
        environment.compute_type
        environment.image
        environment.type

        some source in codebuild_project.expressions.source
        source.type.constant_value == "GITHUB"
        source.location
}

default valid := false

valid if {
        resources := input.configuration.root_module.resources
        some codebuild_project in resources
        codebuild_project.type == "aws_codebuild_project"
        some security_group in resources
        codebuild_project_valid(codebuild_project)
}