znyang/ambig-iac huggingface dataset:
Task: Create a db.t4g.large AWS PostgresSQL

Specification:
Has one "aws_db_instance" resource
with one "allocated_storage" minimun value is 20
with one "engine" with value "postgres"
with one "instance_class" with value "db.t4g.large"
with one "password"
with one "username"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "postgres"
  instance_class       = "db.t4g.large"
  username             = "foo"
  password             = "foobarbaz"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_db_instance"
        has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_db_instance"
        requirement1(resource.expressions)
        requirement2(resource.expressions)
    requirement3(resource.expressions)
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
        expressions.allocated_storage.constant_value >= 20
        expressions.engine.constant_value == "postgres"
    expressions.username
        is_valid_engine(expressions.engine.constant_value)
}

requirement2(expressions) {
        expressions.instance_class.constant_value == "db.t4g.large"
        is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
        expressions.password
}

requirement3(expressions) {
        expressions.manage_master_user_password
}

requirement3(expressions) {
        expressions.snapshot_identifier
}

requirement3(expressions) {
        expressions.replicate_source_db
}

requirement3(expressions) {
        expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
        engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
        engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
        instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
        startswith(instance_class, prefix)
}
Task: create a memory optimized PostgresSQL

Specification:
Has one "aws_db_instance" resource
with one "allocated_storage" minimun value is 20
with one "engine" with value "postgres"
with one "instance_class" with valid memory-optimized class
with one "password"
with one "username"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "postgres"
  instance_class       = "db.z1d.micro"
  username             = "foo"
  password             = "foobarbaz"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_db_instance"
        has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_db_instance"
        requirement1(resource.expressions)
        requirement2(resource.expressions)
    requirement3(resource.expressions)
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
        expressions.allocated_storage.constant_value >= 20
        expressions.engine.constant_value == "postgres"
    expressions.username
        is_valid_engine(expressions.engine.constant_value)
}

requirement2(expressions) {
        expressions.instance_class
        is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
        expressions.password
}

requirement3(expressions) {
        expressions.manage_master_user_password
}

requirement3(expressions) {
        expressions.snapshot_identifier
}

requirement3(expressions) {
        expressions.replicate_source_db
}

requirement3(expressions) {
        expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
        engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
        engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
        instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
        startswith(instance_class, prefix)
}
Task: Create an AWS mySQL instance. Any changes on it will be applied immediately

Specification:
Has one "aws_db_instance" resource
with one "allocated_storage"
with one "engine" with value "mysql"
with one "instance_class" 
with one "password"
with one "username"
with one "apply_immediately" set to true

Terraform configuration (main.tf):
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.z1d.micro"
  username             = "foo"
  password             = "foobarbaz"
  apply_immediately = true
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	requirement1(resource.expressions)
	requirement2(resource.expressions)
    requirement3(resource.expressions)
    resource.expressions.apply_immediately.constant_value == true
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
	expressions.allocated_storage
	expressions.engine
    expressions.username
	is_valid_engine(expressions.engine.constant_value)
}

requirement1(expressions) {
	expressions.snapshot_identifier
}

requirement1(expressions) {
	expressions.replicate_source_db
}

requirement2(expressions) {
	expressions.instance_class
	is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
	expressions.password
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

requirement3(expressions) {
	expressions.snapshot_identifier
}

requirement3(expressions) {
	expressions.replicate_source_db
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
	engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
	engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
	instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
	startswith(instance_class, prefix)
}
Task: Create an AWS mySQL instance that skips the final snapshot

Specification:
Has one "aws_db_instance" resource
with one "allocated_storage"
with one "engine" with value "mysql"
with one "instance_class" 
with one "password"
with one "username"
with one "skip_final_snapshot" set to true

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.z1d.micro"
  username             = "foo"
  password             = "foobarbaz"
  skip_final_snapshot = true
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_db_instance"
        has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_db_instance"
        requirement1(resource.expressions)
        requirement2(resource.expressions)
    requirement3(resource.expressions)
    resource.expressions.skip_final_snapshot.constant_value == true
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
        expressions.allocated_storage
        expressions.engine
    expressions.username
        is_valid_engine(expressions.engine.constant_value)
}

requirement1(expressions) {
        expressions.snapshot_identifier
}

requirement1(expressions) {
        expressions.replicate_source_db
}

requirement2(expressions) {
        expressions.instance_class
        is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
        expressions.password
}

requirement3(expressions) {
        expressions.manage_master_user_password
}

requirement3(expressions) {
        expressions.snapshot_identifier
}

requirement3(expressions) {
        expressions.replicate_source_db
}

requirement3(expressions) {
        expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
        engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
        engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
        instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
        startswith(instance_class, prefix)
}
Task: create a aws relational database from a snapshot

Specification:
Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_instance" "replica" {
  snapshot_identifier = "your identifier"
  instance_class       = "db.z1d.micro"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	requirement1(resource.expressions)
	requirement2(resource.expressions)
    requirement3(resource.expressions)
}


requirement1(expressions) {
	expressions.snapshot_identifier
}

requirement2(expressions) {
	expressions.instance_class
	is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
	expressions.password
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

requirement3(expressions) {
	expressions.snapshot_identifier
}

requirement3(expressions) {
	expressions.replicate_source_db
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
	engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
	engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
	instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
	startswith(instance_class, prefix)
}
Task: create a basic AWS RDS instance, with gp3 storage type

Specification:
Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  password             = "foobarbaz"
  storage_type        = "gp3"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	requirement1(resource.expressions)
	requirement2(resource.expressions)
    requirement3(resource.expressions)
    resource.expressions.storage_type.constant_value == "gp3"
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
	expressions.allocated_storage.constant_value >= 20
    expressions.allocated_storage.constant_value <= 65536
	expressions.engine
    expressions.username
	is_valid_engine(expressions.engine.constant_value)
}

requirement2(expressions) {
	expressions.instance_class
	is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
	expressions.password
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

requirement3(expressions) {
	expressions.snapshot_identifier
}

requirement3(expressions) {
	expressions.replicate_source_db
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
	engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
	engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
	instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
	startswith(instance_class, prefix)
}
Task: create a basic AWS RDS instance, with io1 storage type

Specification:
Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 100
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  password             = "foobarbaz"
  storage_type        = "io1"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	requirement1(resource.expressions)
	requirement2(resource.expressions)
    requirement3(resource.expressions)
    resource.expressions.storage_type.constant_value == "io1"
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
	expressions.allocated_storage.constant_value >= 100
    expressions.allocated_storage.constant_value <= 65536
	expressions.engine
    expressions.username
	is_valid_engine(expressions.engine.constant_value)
}

requirement2(expressions) {
	expressions.instance_class
	is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
	expressions.password
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

requirement3(expressions) {
	expressions.snapshot_identifier
}

requirement3(expressions) {
	expressions.replicate_source_db
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
	engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
	engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
	instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
	startswith(instance_class, prefix)
}
Task: create an aws database restored from s3

Specification:
Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"
    with one s3_import
        with one bucket_name
        with one ingestion_role
        with one source_engine
        with one source_engine_verison

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 20
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  password             = "foobarbaz"
  s3_import {
    bucket_name           = "mybucket"
    ingestion_role        = "arn:aws:iam::1234567890:role/role-xtrabackup-rds-restore"
    source_engine         = "mysql"
    source_engine_version = "5.6"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	requirement1(resource.expressions)
	requirement2(resource.expressions)
    requirement3(resource.expressions)
    resource.expressions.s3_import
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
	expressions.allocated_storage
	expressions.engine
    expressions.username
	is_valid_engine(expressions.engine.constant_value)
}

requirement1(expressions) {
	expressions.snapshot_identifier
}

requirement1(expressions) {
	expressions.replicate_source_db
}

requirement2(expressions) {
	expressions.instance_class
	is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
	expressions.password
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

requirement3(expressions) {
	expressions.snapshot_identifier
}

requirement3(expressions) {
	expressions.replicate_source_db
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
	engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
	engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
	instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
	startswith(instance_class, prefix)
}