znyang/ambig-iac huggingface dataset:
Task: create an AWS database that enables storage autoscaling

Specification:
Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"
    with one max_allocated_storage

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  password             = "foobarbaz"
  max_allocated_storage = 100
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	requirement1(resource.expressions)
	requirement2(resource.expressions)
    requirement3(resource.expressions)
    resource.expressions.max_allocated_storage.constant_value >  resource.expressions.allocated_storage.constant_value
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
	expressions.allocated_storage
	expressions.engine
    expressions.username
	is_valid_engine(expressions.engine.constant_value)
}

requirement1(expressions) {
	expressions.snapshot_identifier
}

requirement1(expressions) {
	expressions.replicate_source_db
}

requirement2(expressions) {
	expressions.instance_class
	is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
	expressions.password
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

requirement3(expressions) {
	expressions.snapshot_identifier
}

requirement3(expressions) {
	expressions.replicate_source_db
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
	engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
	engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
	instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
	startswith(instance_class, prefix)
}
Task: create an aws database that Managed Master Passwords via Secrets Manager, default KMS Key

Specification:
Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "username"
    with one manage_master_user_password

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  manage_master_user_password = true
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	requirement1(resource.expressions)
	requirement2(resource.expressions)
    requirement3(resource.expressions)
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
	expressions.allocated_storage
	expressions.engine
    expressions.username
	is_valid_engine(expressions.engine.constant_value)
}

requirement1(expressions) {
	expressions.snapshot_identifier
}

requirement1(expressions) {
	expressions.replicate_source_db
}

requirement2(expressions) {
	expressions.instance_class
	is_valid_instance_class(expressions.instance_class.constant_value)
}


requirement3(expressions) {
	expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
	engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
	engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
	instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
	startswith(instance_class, prefix)
}
Task: create an aws database that Managed Master Passwords via Secrets Manager, with specific KMS Key

Specification:
Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "username"
    with one manage_master_user_password
    with one "master_user_secret_kms_key_id"  
 
has one "aws_kms_key"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  manage_master_user_password = true
  master_user_secret_kms_key_id = aws_kms_key.example.key_id
}

resource "aws_kms_key" "example" {
  description = "Example KMS Key"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false
default is_valid_kms_key = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	has_required_db_arguments
}

is_valid_kms_key {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_kms_key"
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	requirement1(resource.expressions)
	requirement2(resource.expressions)
    requirement3(resource.expressions)
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
	expressions.allocated_storage
	expressions.engine
    expressions.username
	is_valid_engine(expressions.engine.constant_value)
}

requirement1(expressions) {
	expressions.snapshot_identifier
}

requirement1(expressions) {
	expressions.replicate_source_db
}

requirement2(expressions) {
	expressions.instance_class
	is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
	expressions.password
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

requirement3(expressions) {
	expressions.snapshot_identifier
}

requirement3(expressions) {
	expressions.replicate_source_db
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
	engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
	engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
	instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
	startswith(instance_class, prefix)
}
Task: create a AWS EFS File System with tags

Specification:
Have one "aws_efs_file_system" resource
    with one tags

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_efs_file_system" "foo" {
  creation_token = "my-product"

  tags = {
    Name = "MyProduct"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_efs_file_system = false

# Rule to check if a valid aws_efs_file_system exists
is_valid_efs_file_system {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_efs_file_system"
    resource.expressions.tags
}
Task: create a AWS EFS Using lifecycle policy

Specification:
Have one "aws_efs_file_system" resource

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_efs_file_system" "foo_with_lifecyle_policy" {
  creation_token = "my-product"

  lifecycle_policy {
    transition_to_ia = "AFTER_30_DAYS"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_efs_file_system = false

# Rule to check if a valid aws_efs_file_system exists
is_valid_efs_file_system {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_efs_file_system"
    resource.expressions.lifecycle_policy
}
Task: create a AWS EFS with a system policy

Specification:
Have one "aws_efs_file_system" resource

Have one "aws_efs_file_system_policy" resource
with one "file_system_id"
with one "policy"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_efs_file_system" "fs" {
  creation_token = "my-product"
}

data "aws_iam_policy_document" "policy" {
  statement {
    sid    = "ExampleStatement01"
    effect = "Allow"

    principals {
      type        = "AWS"
      identifiers = ["*"]
    }

    actions = [
      "elasticfilesystem:ClientMount",
      "elasticfilesystem:ClientWrite",
    ]

    resources = [aws_efs_file_system.fs.arn]

    condition {
      test     = "Bool"
      variable = "aws:SecureTransport"
      values   = ["true"]
    }
  }
}

resource "aws_efs_file_system_policy" "policy" {
  file_system_id = aws_efs_file_system.fs.id
  policy         = data.aws_iam_policy_document.policy.json
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_efs_setup = false

# Rule to check if a valid aws_efs_file_system and aws_efs_file_system_policy exists
is_valid_efs_setup {
    has_valid_efs_file_system
    has_valid_efs_file_system_policy
}

# Helper rule to check if a valid aws_efs_file_system exists
has_valid_efs_file_system {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_efs_file_system"
}

# Helper rule to check if a valid aws_efs_file_system_policy exists with required arguments
has_valid_efs_file_system_policy {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_efs_file_system_policy"
    resource.expressions.file_system_id
    resource.expressions.policy
}
Task: create a AWS EFS with automatic backups enabled

Specification:
Have one "aws_efs_file_system" resource

Have one "aws_efs_backup_policy" resource
with one "file_system_id"
with one "backup_policy"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_efs_file_system" "fs" {
  creation_token = "my-product"
}

resource "aws_efs_backup_policy" "policy" {
  file_system_id = aws_efs_file_system.fs.id

  backup_policy {
    status = "ENABLED"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_efs_setup = false

# Rule to check if a valid aws_efs_file_system and aws_efs_file_system_policy exists
is_valid_efs_setup {
    has_valid_efs_file_system
    has_valid_aws_efs_backup_policy
}

# Helper rule to check if a valid aws_efs_file_system exists
has_valid_efs_file_system {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_efs_file_system"
}

# Helper rule to check if a valid aws_efs_file_system_policy exists with required arguments
has_valid_aws_efs_backup_policy {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_efs_backup_policy"
    resource.expressions.backup_policy
    resource.expressions.file_system_id
}
Task: create a AWS EFS with mount target

Specification:
Have one "aws_efs_file_system" resource

Have one "aws_efs_mount_target" resource
with one "file_system_id"
with one "subnet_id"

Have one "aws_subnet" resource
(FOR SUBNET_ID IN MOUNT_TARGET)

Have one "aws_vpc" resource
(FOR VPC_ID IN "AWS_SUBNET")

Terraform configuration (main.tf):
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_efs_file_system" "foo" {
  creation_token = "my-product"

  tags = {
    Name = "MyProduct"
  }
}

resource "aws_efs_mount_target" "alpha" {
  file_system_id = aws_efs_file_system.foo.id
  subnet_id      = aws_subnet.alpha.id
}

resource "aws_vpc" "foo" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "alpha" {
  vpc_id            = aws_vpc.foo.id
  availability_zone = "us-west-2a"
  cidr_block        = "10.0.1.0/24"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_efs_setup = false

# Rule to check if a valid aws_efs_file_system and aws_efs_file_system_policy exists
is_valid_efs_setup {
    has_valid_efs_file_system
    has_valid_aws_efs_mount_target
    is_valid_vpc
    is_valid_subnet
}

# Helper rule to check if a valid aws_efs_file_system exists
has_valid_efs_file_system {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_efs_file_system"
}

# Helper rule to check if a valid aws_efs_file_system_policy exists with required arguments
has_valid_aws_efs_mount_target {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_efs_mount_target"
    resource.expressions.file_system_id
    resource.expressions.subnet_id
}

has_valid_vpc {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_efs_mount_target"
    resource.expressions.file_system_id
    resource.expressions.subnet_id
}


# has one vpc resource
is_valid_vpc {
        have_required_vpc_argument
}

have_required_vpc_argument {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_vpc"
        resource.expressions.cidr_block.constant_value != null
}

have_required_vpc_argument {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_vpc"
        resource.expressions.ipv4_ipam_pool_id.constant_value != null
}

# has valid subnet
is_valid_subnet {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_subnet"
        resource.expressions.vpc_id != null
        have_required_subnet_argument
}

have_required_subnet_argument {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_subnet"
        resource.expressions.cidr_block != null
}

have_required_subnet_argument {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_subnet"
        resource.expressions.ipv6_cider_block != null
}
Task: sets up a dedicated-tenancy AWS VPC with DNS support and hostnames enabled, an internet gateway, and a route table for outbound internet access, all tagged with a variable name.

Specification:
Has one "aws_vpc" resource
with a specified "cidr_block"
with "enable_dns_support" and "enable_dns_hostnames" set to true
with "instance_tenancy" set to "dedicated"
with a "tags" map including a "Name" key referencing a variable

Has one "aws_internet_gateway" resource
with "vpc_id" referencing the "aws_vpc" resource
with a "tags" map including a "Name" key referencing a variable

Has one "aws_route_table" resource
with "vpc_id" referencing the "aws_vpc" resource
containing a default route for internet access through the "aws_internet_gateway"
with a "tags" map including a "Name" key referencing a variable

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_vpc" "dgraph" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  instance_tenancy     = "dedicated"

  # For enabling assignment of private dns addresses within AWS.
  enable_dns_hostnames = true

  tags = {
    Name = "var.name"
  }
}

resource "aws_internet_gateway" "dgraph_gw" {
  vpc_id = aws_vpc.dgraph.id

  tags = {
    Name = "var.name"
  }
}

resource "aws_route_table" "dgraph_igw" {
  vpc_id = aws_vpc.dgraph.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.dgraph_gw.id
  }

  tags = {
    Name = "var.name"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_vpc = false
default is_valid_internet_gateway = false
default is_valid_route_table = false

# Validate aws_vpc resource
is_valid_vpc {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_vpc"
    resource.expressions.cidr_block != null
    resource.expressions.enable_dns_support.constant_value == true
    resource.expressions.enable_dns_hostnames.constant_value == true
    resource.expressions.instance_tenancy.constant_value == "dedicated"
    resource.expressions.tags.constant_value["Name"] != null
}

# Validate aws_internet_gateway resource
is_valid_internet_gateway {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_internet_gateway"
    resource.expressions.vpc_id.references[0] == "aws_vpc.dgraph.id"
    resource.expressions.tags.constant_value["Name"] != null
}

# Validate aws_route_table resource
is_valid_route_table {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route_table"
    resource.expressions.vpc_id.references[0] == "aws_vpc.dgraph.id"
    resource.expressions.route.references[0] == "aws_internet_gateway.dgraph_gw.id"
    resource.expressions.tags.constant_value["Name"] != null
}
Task: sets up a dedicated-tenancy AWS VPC with DNS support and hostnames enabled, an internet gateway, and a route table for outbound internet access, all tagged with a variable name.

Specification:
Has one "aws_vpc" resource
with a specified "cidr_block"
with "enable_dns_support" and "enable_dns_hostnames" set to true

Has one "aws_internet_gateway" resource
with "vpc_id" referencing the "aws_vpc" resource
with a "tags" map including a "Name" key referencing a variable

Has one "aws_route_table" resource
with "vpc_id" referencing the "aws_vpc" resource
containing a default route for internet access through the "aws_internet_gateway"
with a "tags" map including a "Name" key referencing a variable

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_vpc" "dgraph" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  instance_tenancy     = "dedicated"

  # For enabling assignment of private dns addresses within AWS.
  enable_dns_hostnames = true

  tags = {
    Name = "var.name"
  }
}

resource "aws_internet_gateway" "dgraph_gw" {
  vpc_id = aws_vpc.dgraph.id

  tags = {
    Name = "var.name"
  }
}

resource "aws_route_table" "dgraph_igw" {
  vpc_id = aws_vpc.dgraph.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.dgraph_gw.id
  }

  tags = {
    Name = "var.name"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_vpc = false
default is_valid_internet_gateway = false
default is_valid_route_table = false

# Validate aws_vpc resource
is_valid_vpc {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_vpc"
    resource.expressions.cidr_block != null
    resource.expressions.enable_dns_support.constant_value == true
    resource.expressions.enable_dns_hostnames.constant_value == true
}

# Validate aws_internet_gateway resource
is_valid_internet_gateway {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_internet_gateway"
    resource.expressions.vpc_id.references[0] == "aws_vpc.dgraph.id"
    resource.expressions.tags.constant_value["Name"] != null
}

# Validate aws_route_table resource
is_valid_route_table {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route_table"
    resource.expressions.vpc_id.references[0] == "aws_vpc.dgraph.id"
    resource.expressions.route.references[0] == "aws_internet_gateway.dgraph_gw.id"
    resource.expressions.tags.constant_value["Name"] != null
}