znyang/ambig-iac huggingface dataset:
Task: Create a RedShift cluster with 2 nodes and create an endpoint access for it

Specification:
Create a cluster and a endpoint associated with it

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "example_vpc" {
  cidr_block          = "10.0.0.0/16"
  enable_dns_support  = true
  enable_dns_hostnames = true
}

data "aws_availability_zones" "azs" {
    state = "available"
}

resource "aws_subnet" "subnet_a" {
  vpc_id                = aws_vpc.example_vpc.id
  cidr_block            = "10.0.1.0/24"
  availability_zone     = data.aws_availability_zones.azs.names[0]
  map_public_ip_on_launch = true
}

resource "aws_subnet" "subnet_b" {
  vpc_id                = aws_vpc.example_vpc.id
  cidr_block            = "10.0.2.0/24"
  availability_zone     = data.aws_availability_zones.azs.names[1]
  map_public_ip_on_launch = true
}

# Create the Redshift subnet group
resource "aws_redshift_subnet_group" "example_subnet_group" {
  name        = "example-subnet-group"
  description = "Example Redshift subnet group"

  subnet_ids = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "redshift-cluster-1"
  node_type          = "dc2.large"
  cluster_type       = "multi-node"
  number_of_nodes    = 2

  database_name = "mydb"
  master_username = "foo"
  master_password = "Mustbe8characters"

  skip_final_snapshot = true
}

resource "aws_redshift_endpoint_access" "example" {
  endpoint_name      = "example"
  subnet_group_name  = aws_redshift_subnet_group.example_subnet_group.id
  cluster_identifier = aws_redshift_cluster.example.cluster_identifier
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if AWS Redshift cluster with 2 nodes is being created
aws_redshift_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 2
}

# Check if AWS Redshift endpoint access is being created
aws_redshift_endpoint_access_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_endpoint_access"
}

# Aggregate all checks
allow {
    aws_redshift_cluster_valid(input.resource_changes)
    aws_redshift_endpoint_access_valid(input.resource_changes)
}
Task: Create a Lambda Layer Version resource from "lambda_layer_payload.zip"

Specification:
Create a aws_lambda_layer_version by using file_name = "lambda_layer_payload.zip". Layer name can be any.

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_lambda_layer_version" "lambda_layer" {
  filename   = "lambda_layer_payload.zip"
  layer_name = "lambda_layer_name"

  compatible_runtimes = ["nodejs16.x"]
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if the AWS Lambda Layer Version is valid
aws_lambda_layer_version_valid(resources) {
    some resource in resources
    resource.type == "aws_lambda_layer_version"
    resource.change.after.filename == "lambda_layer_payload.zip"
}

# Aggregate all checks
allow {
    aws_lambda_layer_version_valid(input.resource_changes)
}
Task: Create a CloudWatch Composite Alarm resource.

Specification:
Creates an aws_cloudwatch_composite_alarm which requires at least one other aws_cloudwatch_metric_alarm

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_cloudwatch_composite_alarm" "example" {
  alarm_name        = "example-composite-alarm"

  alarm_rule = <<EOF
ALARM(${aws_cloudwatch_metric_alarm.foobar.alarm_name})
EOF

}

resource "aws_cloudwatch_metric_alarm" "foobar" {
  alarm_name                = "terraform-test-foobar5"
  comparison_operator       = "GreaterThanOrEqualToThreshold"
  evaluation_periods        = "2"
  metric_name               = "CPUUtilization"
  namespace                 = "AWS/EC2"
  period                    = "120"
  statistic                 = "Average"
  threshold                 = "80"
  alarm_description         = "This metric monitors ec2 cpu utilization"
  insufficient_data_actions = []
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if AWS CloudWatch Composite Alarm is being created
aws_cloudwatch_composite_alarm_valid(resources) {
    some resource in resources
    resource.type == "aws_cloudwatch_composite_alarm"
}

# Aggregate all checks
allow {
    aws_cloudwatch_composite_alarm_valid(input.resource_changes)
}
Task: Create a CloudWatch Metric Alarm resource.

Specification:
Createsr a aws_cloudwatch_metric_alarm

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_cloudwatch_metric_alarm" "foobar" {
  alarm_name                = "terraform-test-foobar5"
  comparison_operator       = "GreaterThanOrEqualToThreshold"
  evaluation_periods        = 2
  metric_name               = "CPUUtilization"
  namespace                 = "AWS/EC2"
  period                    = 120
  statistic                 = "Average"
  threshold                 = 80
  alarm_description         = "This metric monitors ec2 cpu utilization"
  insufficient_data_actions = []
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if AWS CloudWatch Composite Alarm is being created
aws_cloudwatch_composite_alarm_valid(resources) {
    some resource in resources
    resource.type == "aws_cloudwatch_metric_alarm"
}

# Aggregate all checks
allow {
    aws_cloudwatch_composite_alarm_valid(input.resource_changes)
}
Task: Create a DynamoDB Contributor Insights resource for a specific table with custom settings

Specification:
Create a DynamoDB table and enable contributor insights

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_dynamodb_contributor_insights" "test" {
  table_name = "ExampleTableName"
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if AWS DynamoDB Contributor Insights is being created for a specific table
aws_dynamodb_contributor_insights_valid(resources) {
    some resource in resources
    resource.type == "aws_dynamodb_contributor_insights"
}

# Aggregate all checks
allow {
    aws_dynamodb_contributor_insights_valid(input.resource_changes)
}
Task: Create a DynamoDB table with custom read capacity = 20 and write capacity = 20.

Specification:
dynamodb table -> hash_key, name, attribute (name, type), read_capacity = 20, write_capacity = 20

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_dynamodb_table" "basic-dynamodb-table" {
  name           = "GameScores"
  billing_mode   = "PROVISIONED"
  read_capacity  = 20
  write_capacity = 20
  hash_key       = "UserId"
  range_key      = "GameTitle"

  attribute {
    name = "UserId"
    type = "S"
  }

  attribute {
    name = "GameTitle"
    type = "S"
  }

  attribute {
    name = "TopScore"
    type = "N"
  }

  ttl {
    attribute_name = "TimeToExist"
    enabled        = false
  }

  global_secondary_index {
    name               = "GameTitleIndex"
    hash_key           = "GameTitle"
    range_key          = "TopScore"
    write_capacity     = 10
    read_capacity      = 10
    projection_type    = "INCLUDE"
    non_key_attributes = ["UserId"]
  }

  tags = {
    Name        = "dynamodb-table-1"
    Environment = "production"
  }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if AWS DynamoDB table is being created with specific read and write capacity settings
aws_dynamodb_table_custom_capacity_valid(resources) {
    some resource in resources
    resource.type == "aws_dynamodb_table"
    resource.change.after.read_capacity == 20
    resource.change.after.write_capacity == 20

}

# Aggregate all checks
allow {
    aws_dynamodb_table_custom_capacity_valid(input.resource_changes)
}
Task: Provide a DynamoDB table item resource using terraform

Specification:
dynamodb table -> hash_key, name, attribute (name, type), read_capacity = x, write_capacity = x, create a table_item using table name, hashkey, and json item object

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_dynamodb_table_item" "example" {
  table_name = aws_dynamodb_table.example.name
  hash_key   = aws_dynamodb_table.example.hash_key

  item = <<ITEM
{
  "exampleHashKey": {"S": "something"},
  "one": {"N": "11111"},
  "two": {"N": "22222"},
  "three": {"N": "33333"},
  "four": {"N": "44444"}
}
ITEM
}

resource "aws_dynamodb_table" "example" {
  name           = "example-name"
  read_capacity  = 10
  write_capacity = 10
  hash_key       = "exampleHashKey"

  attribute {
    name = "exampleHashKey"
    type = "S"
  }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if AWS DynamoDB table is being created with specific read and write capacity settings
aws_dynamodb_table_item_valid(resources) {
    some resource in resources
    resource.type == "aws_dynamodb_table_item"

}

# Aggregate all checks
allow {
    aws_dynamodb_table_item_valid(input.resource_changes)
}
Task: Create a DynamoDB Global Table and create a replica of the table

Specification:
dynamodb table -> hash_key, name, attribute (name, type) -> create a repilca with the table arn

Terraform configuration (main.tf):
provider "aws" {
  alias  = "alt"
  region = "us-east-2"
}

resource "aws_dynamodb_table" "example" {
  provider         = aws.alt
  name             = "TestTable"
  hash_key         = "BrodoBaggins"
  billing_mode     = "PAY_PER_REQUEST"
  stream_enabled   = true
  stream_view_type = "NEW_AND_OLD_IMAGES"

  attribute {
    name = "BrodoBaggins"
    type = "S"
  }

  lifecycle {
    ignore_changes = [replica]
  }
}

resource "aws_dynamodb_table_replica" "example" {
  provider         = aws.alt
  global_table_arn = aws_dynamodb_table.example.arn

  tags = {
    Name = "IZPAWS"
    Pozo = "Amargo"
  }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dynamodb_table(resources) {
    some resource in resources
    resource.type == "aws_dynamodb_table"
}

# Check if the AWS DynamoDB table replica is being created in us-east-2
aws_dynamodb_table_replica(resources) {
    some resource in resources
    resource.type == "aws_dynamodb_table_replica"
}

# Aggregate all checks
allow {
    aws_dynamodb_table(input.resource_changes)
    aws_dynamodb_table_replica(input.resource_changes)
}
Task: Create a DAX cluster with node type = dax.r4.large and replication factor = 1.

Specification:
require a cluster name, iam_role_arn, node_type, replication factor

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_role" "example" {
  name = "test"

  assume_role_policy = jsonencode({
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "eks.amazonaws.com"
      }
    }]
    Version = "2012-10-17"
  })
}


resource "aws_dax_cluster" "bar" {
  cluster_name       = "cluster-example"
  iam_role_arn       = aws_iam_role.example.arn
  node_type          = "dax.r4.large"
  replication_factor = 1
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dax_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_dax_cluster"
    resource.change.after.node_type == "dax.r4.large"
    resource.change.after.replication_factor == 1
}

# Aggregate all checks
allow {
    aws_dax_cluster_valid(input.resource_changes)
}
Task: Create a custom DAX parameter group

Specification:
require name of the group, list of parameters (key, value) pairs

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_dax_parameter_group" "example" {
  name = "example"

  parameters {
    name  = "query-ttl-millis"
    value = "100000"
  }

  parameters {
    name  = "record-ttl-millis"
    value = "100000"
  }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dax_parameter_group_valid(resources) {
    some resource in resources
    resource.type == "aws_dax_parameter_group"
}

# Aggregate all checks
allow {
    aws_dax_parameter_group_valid(input.resource_changes)
}
Task: Create a custom DAX subnet group

Specification:
create subnets -> create subnet groups

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example1" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_subnet" "example2" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_dax_subnet_group" "example" {
  name       = "example"
  subnet_ids = [aws_subnet.example1.id, aws_subnet.example2.id]
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dax_subnet_group_valid(resources) {
    some resource in resources
    resource.type == "aws_dax_subnet_group"
}

# Aggregate all checks
allow {
    aws_dax_subnet_group_valid(input.resource_changes)
}
Task: Configure on-demand capacity mode for a DynamoDB table.

Specification:
dynamodb table -> hash_key, name, attribute (name, type), billing mode pay per read

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_dynamodb_table" "basic-dynamodb-table" {
  name           = "example"
  billing_mode   = "PAY_PER_REQUEST"
  hash_key       = "UserId"

  attribute {
    name = "UserId"
    type = "S"
  }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if the AWS DynamoDB table is being created in us-east-1
aws_dynamodb_table_valid(resources) {
    some resource in resources
    resource.type == "aws_dynamodb_table"
    resource.change.after.billing_mode == "PAY_PER_REQUEST"
}

# Aggregate all checks
allow {
    aws_dynamodb_table_valid(input.resource_changes)
}
Task: Create a SageMaker Domain resource.

Specification:
Has a sagemaker domain resources which requires a an iam role and a subnet

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example" {
  vpc_id     = aws_vpc.example.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_sagemaker_domain" "example" {
  domain_name = "example"
  auth_mode   = "IAM"
  vpc_id      = aws_vpc.example.id
  subnet_ids  = [aws_subnet.example.id]

  default_user_settings {
    execution_role = aws_iam_role.example.arn
  }
}

resource "aws_iam_role" "example" {
  name               = "example"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.example.json
}

data "aws_iam_policy_document" "example" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false


aws_sagemaker_domain_valid(resources) {
    some resource in resources
    resource.type == "aws_sagemaker_domain"
}

aws_iam_role_valid(resources) {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_vpc_valid(resources) {
    some resource in resources
    resource.type == "aws_vpc"
}

aws_subnet_valid(resources) {
    some resource in resources
    resource.type == "aws_subnet"
}

# Aggregate all checks
allow {
    aws_sagemaker_domain_valid(input.resource_changes)
    aws_iam_role_valid(input.resource_changes)
    aws_vpc_valid(input.resource_changes)
    aws_subnet_valid(input.resource_changes)
}
Task: Create a SageMaker user profile resource

Specification:
Has a sagemaker user profile resource which depends on a sagemaker domain resource

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example" {
  vpc_id     = aws_vpc.example.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_sagemaker_domain" "example" {
  domain_name = "example"
  auth_mode   = "IAM"
  vpc_id      = aws_vpc.example.id
  subnet_ids  = [aws_subnet.example.id]

  default_user_settings {
    execution_role = aws_iam_role.example.arn
  }
}

resource "aws_iam_role" "example" {
  name               = "example"
  path               = "/"
  assume_role_policy = data.aws_iam_policy_document.example.json
}

data "aws_iam_policy_document" "example" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["sagemaker.amazonaws.com"]
    }
  }
}

resource "aws_sagemaker_user_profile" "example" {
  domain_id         = aws_sagemaker_domain.example.id
  user_profile_name = "example"
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false


aws_sagemaker_domain_valid(resources) {
    some resource in resources
    resource.type == "aws_sagemaker_domain"
}

aws_iam_role_valid(resources) {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_vpc_valid(resources) {
    some resource in resources
    resource.type == "aws_vpc"
}

aws_subnet_valid(resources) {
    some resource in resources
    resource.type == "aws_subnet"
}

aws_sagemaker_user_profile_valid(resources) {
    some resource in resources
    resource.type == "aws_sagemaker_user_profile"
}

# Aggregate all checks
allow {
    aws_sagemaker_domain_valid(input.resource_changes)
    aws_iam_role_valid(input.resource_changes)
    aws_vpc_valid(input.resource_changes)
    aws_subnet_valid(input.resource_changes)
    aws_sagemaker_user_profile_valid(input.resource_changes)
}
Task: Create the latest Amazon Linux 2 AMI

Specification:
create aws_ami resource with name = any

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

data "aws_ami" "latest_amazon_linux_2" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

Validation policy (checks.rego):
package terraform

default ami_latest_amazon_linux_2 = false

ami_latest_amazon_linux_2 {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_ami"
    resource.name == "latest_amazon_linux_2"
    resource.expressions.filter[_].name.constant_value == "name"
    resource.expressions.filter[_].values.constant_value[_] == "amzn2-ami-hvm-*-x86_64-gp2"
    resource.expressions.most_recent.constant_value == true
    resource.expressions.owners.constant_value[_] == "amazon"
}
Task: Provide a resource to reduce the number of database calls.

Specification:
requires cluster id, engine=memcached, node_type, num_cache_nodes, parameter_group_name

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_elasticache_cluster" "example" {
  cluster_id           = "cluster-example"
  engine               = "memcached"
  node_type            = "cache.m4.large"
  num_cache_nodes      = 2
  parameter_group_name = "default.memcached1.4"
  port                 = 11211
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_elasticache_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_elasticache_cluster"
    resource.change.after.engine == "memcached"
}

# Aggregate all checks
allow {
    aws_elasticache_cluster_valid(input.resource_changes)
}
Task: authenticate a elasticache user with redis

Specification:
requires access string, engine = REDIS, user id and user name

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
  engine        = "REDIS"
  passwords     = ["password123456789"]
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_elasticache_user_valid(resources) {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.engine == "REDIS"
}

# Aggregate all checks
allow {
    aws_elasticache_user_valid(input.resource_changes)
}
Task: authenticate a elasticache user with iam

Specification:
requires access string, engine = REDIS, user id and user name, authentication_mode {type = "iam"}

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~* +@all"
  engine        = "REDIS"

  authentication_mode {
    type = "iam"
  }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_elasticache_user_valid(resources) {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.authentication_mode[_].type == "iam"
}

# Aggregate all checks
allow {
    aws_elasticache_user_valid(input.resource_changes)
}