Task: Set up a highly available Amazon Redshift cluster across multiple us-east-1a and us-east-1b

Specification:
Create a VPC, create internet_gateway,create 2 subnets (1 in east1a and 1 in east1b) then create a redshift_subnet_group

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "example_vpc" {
  cidr_block          = "10.0.0.0/16"
  enable_dns_support  = true
  enable_dns_hostnames = true
}

resource "aws_internet_gateway" "gw" {
  vpc_id = aws_vpc.example_vpc.id
}

data "aws_availability_zones" "azs" {
    state = "available"
}

# Create subnet in us-east-1a
resource "aws_subnet" "subnet_a" {
  vpc_id                = aws_vpc.example_vpc.id
  cidr_block            = "10.0.1.0/24"
  availability_zone     = data.aws_availability_zones.azs.names[0]
  map_public_ip_on_launch = true
}

# Create subnet in us-east-1b
resource "aws_subnet" "subnet_b" {
  vpc_id                = aws_vpc.example_vpc.id
  cidr_block            = "10.0.2.0/24"
  availability_zone     = data.aws_availability_zones.azs.names[1]
  map_public_ip_on_launch = true
}

# Create the Redshift subnet group
resource "aws_redshift_subnet_group" "example_subnet_group" {
  name        = "example-subnet-group"
  description = "Example Redshift subnet group"

  subnet_ids = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "redshift-cluster-1"
  node_type          = "dc2.large"
  cluster_type       = "multi-node"
  number_of_nodes    = 2

  database_name = "mydb"
  master_username = "foo"
  master_password = "Mustbe8characters"

  cluster_subnet_group_name   = aws_redshift_subnet_group.example_subnet_group.name

  skip_final_snapshot = true
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Function to check if Redshift cluster is set up for high availability
aws_redshift_cluster_ha_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.cluster_type == "multi-node"
    resource.change.after.number_of_nodes > 1
    resource.change.after.cluster_subnet_group_name != null
}

aws_internet_gateway_valid(resources) {
    some resource in resources
    resource.type == "aws_internet_gateway"
}

# Function to check if subnets are created in east-1a and east-1b
aws_subnets_valid(resources) {
    subnet_a_valid(resources)
    subnet_b_valid(resources)
}

subnet_a_valid(resources) {
    some resource in resources
    resource.type == "aws_subnet"
    resource.change.after.availability_zone == "us-east-1a"
}

subnet_b_valid(resources) {
    some resource in resources
    resource.type == "aws_subnet"
    resource.change.after.availability_zone == "us-east-1b"
}

# Function to check if a Redshift subnet group spans across us-east-1a and us-east-1b
aws_redshift_subnet_group_valid(root_module_resources) {
    some resource in root_module_resources
    resource.type == "aws_redshift_subnet_group"
    count(resource.expressions.subnet_ids.references) == 4

}

# Aggregate all checks
allow {
    aws_redshift_cluster_ha_valid(input.resource_changes)
    aws_internet_gateway_valid(input.resource_changes)
    aws_subnets_valid(input.resource_changes)
    aws_redshift_subnet_group_valid(input.configuration.root_module.resources)
}