Task: Set up an AWS provider for the specified region. Retrieve the current caller identity using 'aws_caller_identity'. Optionally, fetch the latest stable ECR image tagged as 'stable' from the specified repository. Define local variables including an image tag, AWS tags, and workspace name. Instantiate an EKS module with configurations for cluster setup, IAM policies, instance types, and node count. Retrieve information about the created EKS cluster and its authentication data. Configure Helm and Kubernetes providers using the EKS cluster's details for cluster communication.

Specification:
has one "aws_caller_identity" data source named "current"
has one "aws_ecr_image" 
with one "repository_name"
with one "image_tag"

has multiple local variables defining:
"image_tag" 
"aws_tags"
"workspace_name"

has one module named "eks"

has one "aws_eks_cluster" data source named "aptos"
with one "name"
with a "depends_on" 
has one "aws_eks_cluster_auth"
with one "name"

has one "helm" provider
has one "kubernetes" provider


Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

variable "cluster_name" {
  type = string
  default = "test-cluster"
}

data "aws_region" "current" {}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

data "aws_availability_zones" "available" {
  state = "available"
}

resource "aws_subnet" "test_eks_1" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"

  availability_zone = data.aws_availability_zones.available.names[0]
}

resource "aws_subnet" "test_eks_2" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.2.0/24"

  availability_zone = data.aws_availability_zones.available.names[1]
}

resource "aws_iam_role" "example" {
  name = "${var.cluster_name}-eks"

  assume_role_policy = jsonencode({
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "eks.amazonaws.com"
      }
    }]
    Version = "2012-10-17"
  })
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example.name
}

resource "aws_eks_cluster" "example" {
  name     = var.cluster_name
  role_arn = aws_iam_role.example.arn

  vpc_config {
    subnet_ids = [ aws_subnet.test_eks_1.id, aws_subnet.test_eks_2.id ]
  }

  # Ensure that IAM Role permissions are created before and deleted after EKS Cluster handling.
  # Otherwise, EKS will not be able to properly delete EKS managed EC2 infrastructure such as Security Groups.
  depends_on = [
    aws_iam_role_policy_attachment.eks_cluster_policy,
    aws_iam_role_policy_attachment.eks_service_policy,
  ]

  # Manage kubectl configuration
  provisioner "local-exec" {
    command = "aws eks --region ${data.aws_region.current.name} update-kubeconfig --name ${self.name}"
  }

  provisioner "local-exec" {
    when    = destroy
    command = "kubectl config unset users.${self.arn}"
  }
  provisioner "local-exec" {
    when    = destroy
    command = "kubectl config unset clusters.${self.arn}"
  }
  provisioner "local-exec" {
    when    = destroy
    command = "kubectl config unset contexts.${self.arn}"
  }
}


Validation policy (checks.rego):
package terraform.validation

default has_aws_eks_cluster = false
default has_aws_iam_role = false
default has_aws_iam_role_policy_attachment_eks_cluster = false
default has_aws_iam_role_policy_attachment_eks_service = false

has_aws_eks_cluster {
    some i
    eks_cluster := input.configuration.root_module.resources[i]
    eks_cluster.type == "aws_eks_cluster"
    eks_cluster.expressions.name != null
    eks_cluster.expressions.role_arn != null
    eks_cluster.expressions.vpc_config[_].subnet_ids != null
    count(eks_cluster.expressions.vpc_config[_].subnet_ids) > 0
    count(eks_cluster.depends_on) > 0
    has_local_exec_provisioners(eks_cluster)
}


has_local_exec_provisioners(resource) {
    resource.provisioners != null
    local_exec_count := [provisioner | 
        provisioner := resource.provisioners[_]; 
        provisioner.type == "local-exec"
    ]
    count(local_exec_count) > 0
    has_local_exec_command(local_exec_count)
}


has_local_exec_command(provisioners) {
    some i
    provisioners[i].expressions.command != null
}

has_aws_iam_role {
    some i
    iam_role := input.planned_values.root_module.resources[i]
    iam_role.type == "aws_iam_role"
    iam_role.values.name != null
    iam_role.values.assume_role_policy != null
}


has_aws_iam_role_policy_attachment_eks_cluster {
    some i
    policy_attachment := input.planned_values.root_module.resources[i]
    policy_attachment.type == "aws_iam_role_policy_attachment"
    policy_attachment.values.policy_arn == "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
}


has_aws_iam_role_policy_attachment_eks_service {
    some i
    policy_attachment := input.planned_values.root_module.resources[i]
    policy_attachment.type == "aws_iam_role_policy_attachment"
    policy_attachment.values.policy_arn == "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
}

valid_configuration {
    has_aws_eks_cluster
    has_aws_iam_role
    has_aws_iam_role_policy_attachment_eks_cluster
    has_aws_iam_role_policy_attachment_eks_service
}