Task: Set up a basic AWS Neptune cluster with a custom parameter group and an instance in that cluster with its own custom parameter group

Specification:
Has "aws_neptune_cluster"
with "neptune_cluster_parameter_group_name"

Has "aws_neptune_cluster_parameter_group"
with family = "neptune1.2"

Has "aws_neptune_cluster_instance"
with "cluster_identifier"
with "neptune_parameter_group_name"
with "publicly_accessible" = false OR a subnet group defined

Has "aws_neptune_parameter_group"
with family = "neptune1.2"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_neptune_cluster_parameter_group" "example" {
  family      = "neptune1.2"
  name        = "example"
  description = "neptune cluster parameter group"

  parameter {
    name  = "neptune_enable_audit_log"
    value = 1
  }
}

resource "aws_neptune_parameter_group" "example" {
  family = "neptune1.2"
  name   = "example"

  parameter {
    name  = "neptune_query_timeout"
    value = "25"
  }
}

resource "aws_neptune_cluster" "default" {
  cluster_identifier                  = "neptune-cluster-demo"
  engine                              = "neptune"
  backup_retention_period             = 5
  preferred_backup_window             = "07:00-09:00"
  skip_final_snapshot                 = true
  iam_database_authentication_enabled = true
  apply_immediately                   = true
  neptune_cluster_parameter_group_name = aws_neptune_cluster_parameter_group.example.id
}

resource "aws_neptune_cluster_instance" "example" {
  count              = 2
  cluster_identifier = aws_neptune_cluster.default.id
  engine             = "neptune"
  instance_class     = "db.t3.medium"
  apply_immediately  = true
  publicly_accessible = true
  neptune_parameter_group_name = aws_neptune_parameter_group.example.id
}

Validation policy (checks.rego):
package aws_neptune_cluster
import future.keywords.in

default valid := false

# See for more info: https://docs.aws.amazon.com/neptune/latest/userguide/parameter-groups.html
default cluster_parameter_group_valid := false
default instance_parameter_group_valid := false

valid {
        some cluster in input.configuration.root_module.resources
        cluster.type == "aws_neptune_cluster"
        cluster_parameter_group_valid

        some instance in input.configuration.root_module.resources
        instance.type == "aws_neptune_cluster_instance"
        cluster.address in instance.expressions.cluster_identifier.references
        instance_parameter_group_valid
}

cluster_parameter_group_valid {
        some cluster in input.configuration.root_module.resources
        cluster.type == "aws_neptune_cluster"

        some cluster_parameter_group in input.configuration.root_module.resources
        cluster_parameter_group.type == "aws_neptune_cluster_parameter_group"
        cluster_parameter_group.address in cluster.expressions.neptune_cluster_parameter_group_name.references

        cluster.expressions.engine_version.constant_value < "1.2.0.0"
        cluster_parameter_group.expressions.family.constant_value == "neptune1"
}

cluster_parameter_group_valid {
        some cluster in input.configuration.root_module.resources
        cluster.type == "aws_neptune_cluster"

        some cluster_parameter_group in input.configuration.root_module.resources
        cluster_parameter_group.type == "aws_neptune_cluster_parameter_group"
        cluster_parameter_group.address in cluster.expressions.neptune_cluster_parameter_group_name.references

        cluster.expressions.engine_version.constant_value >= "1.2.0.0"
        cluster_parameter_group.expressions.family.constant_value == "neptune1.2"
}

cluster_parameter_group_valid {
        some cluster in input.configuration.root_module.resources
        cluster.type == "aws_neptune_cluster"

        some cluster_parameter_group in input.configuration.root_module.resources
        cluster_parameter_group.type == "aws_neptune_cluster_parameter_group"
        cluster_parameter_group.address in cluster.expressions.neptune_cluster_parameter_group_name.references

        not cluster.expressions.engine_version.constant_value
        cluster_parameter_group.expressions.family.constant_value == "neptune1.2"
}

instance_parameter_group_valid {
        some instance in input.configuration.root_module.resources
        instance.type == "aws_neptune_cluster_instance"

        some instance_parameter_group in input.configuration.root_module.resources
        instance_parameter_group.type == "aws_neptune_parameter_group"
        instance_parameter_group.address in instance.expressions.neptune_parameter_group_name.references

        instance.expressions.engine_version.constant_value < "1.2.0.0"
        instance_parameter_group.expressions.family.constant_value == "neptune1"
}

instance_parameter_group_valid {
        some instance in input.configuration.root_module.resources
        instance.type == "aws_neptune_cluster_instance"

        some instance_parameter_group in input.configuration.root_module.resources
        instance_parameter_group.type == "aws_neptune_parameter_group"
        instance_parameter_group.address in instance.expressions.neptune_parameter_group_name.references

        instance.expressions.engine_version.constant_value >= "1.2.0.0"
        instance_parameter_group.expressions.family.constant_value == "neptune1.2"
}

instance_parameter_group_valid {
        some instance in input.configuration.root_module.resources
        instance.type == "aws_neptune_cluster_instance"

        some instance_parameter_group in input.configuration.root_module.resources
        instance_parameter_group.type == "aws_neptune_parameter_group"
        instance_parameter_group.address in instance.expressions.neptune_parameter_group_name.references

        not instance.expressions.engine_version.constant_value
        instance_parameter_group.expressions.family.constant_value == "neptune1.2"
}