znyang/ambig-iac huggingface dataset:
Task: Create an AWS aws_ami for the latest Amazon Linux 2 AMI

Specification:
create aws_ami resource with name = any

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

data "aws_ami" "latest_amazon_linux_2" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

Validation policy (checks.rego):
package terraform

default ami_latest_amazon_linux_2 = false

ami_latest_amazon_linux_2 {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_ami"
    resource.name == "latest_amazon_linux_2"
    resource.expressions.filter[_].name.constant_value == "name"
    resource.expressions.filter[_].values.constant_value[_] == "amzn2-ami-hvm-*-x86_64-gp2"
    resource.expressions.most_recent.constant_value == true
    resource.expressions.owners.constant_value[_] == "amazon"
}
Task: Provide a Memcached Cluster

Specification:
requires cluster id, engine=memcached, node_type, num_cache_nodes, parameter_group_name

Terraform configuration (main.tf):
provider "aws" {
  region="us-east-1"
}
resource "aws_elasticache_cluster" "example" {
  cluster_id           = "cluster-example"
  engine               = "memcached"
  node_type            = "cache.m4.large"
  num_cache_nodes      = 2
  parameter_group_name = "default.memcached1.4"
  port                 = 11211
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_elasticache_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_elasticache_cluster"
    resource.change.after.engine == "memcached"
}

# Aggregate all checks
allow {
    aws_elasticache_cluster_valid(input.resource_changes)
}
Task: Provide a Redis Instance

Specification:
requires cluster id, engine=redis, node_type, num_cache_nodes, parameter_group_name

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_elasticache_cluster" "example" {
  cluster_id           = "cluster-example"
  engine               = "redis"
  node_type            = "cache.m4.large"
  num_cache_nodes      = 1
  parameter_group_name = "default.redis3.2"
  engine_version       = "3.2.10"
  port                 = 6379
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_elasticache_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_elasticache_cluster"
    resource.change.after.engine == "redis"
}

# Aggregate all checks
allow {
    aws_elasticache_cluster_valid(input.resource_changes)
}
Task: Provide an ElastiCache user resource with redis

Specification:
requires access string, engine = REDIS, user id and user name

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
  engine        = "REDIS"
  passwords     = ["password123456789"]
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_elasticache_user_valid(resources) {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.engine == "REDIS"
}

# Aggregate all checks
allow {
    aws_elasticache_user_valid(input.resource_changes)
}
Task: Provide an ElastiCache user resource with iam

Specification:
requires access string, engine = REDIS, user id and user name, authentication_mode {type = "iam"}

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~* +@all"
  engine        = "REDIS"

  authentication_mode {
    type = "iam"
  }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_elasticache_user_valid(resources) {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.authentication_mode[_].type == "iam"
}

# Aggregate all checks
allow {
    aws_elasticache_user_valid(input.resource_changes)
}
Task: Provide an ElastiCache user resource with password.

Specification:
requires access string, engine = REDIS, user id and user name, authentication_mode {type= "password", passwords = ["password1", "password2"]}

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "testUserName"
  access_string = "on ~* +@all"
  engine        = "REDIS"

  authentication_mode {
    type      = "password"
    passwords = ["password1", "password2"]
  }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_elasticache_user_valid(resources) {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.authentication_mode[_].type == "password"
}

# Aggregate all checks
allow {
    aws_elasticache_user_valid(input.resource_changes)
}
Task: Provide an ElastiCache user group resource.

Specification:
creates elasticache user resources(requires access string, engine = REDIS, user id and user name) and sets engine , creates group resource using the user ids

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_elasticache_user" "test" {
  user_id       = "testUserId"
  user_name     = "default"
  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember"
  engine        = "REDIS"
  passwords     = ["password123456789"]
}

resource "aws_elasticache_user_group" "test" {
  engine        = "REDIS"
  user_group_id = "userGroupId"
  user_ids      = [aws_elasticache_user.test.user_id]
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_elasticache_user_group_valid(resources) {
    some resource in resources
    resource.type == "aws_elasticache_user_group"
}

# Aggregate all checks
allow {
    aws_elasticache_user_group_valid(input.resource_changes)
}
Task: Associate an existing ElastiCache user and an existing user group.

Specification:
creates elasticache user group and a user resource then associates the 2 using ids

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_elasticache_user" "default" { 
  user_id = "defaultUserID" 
  user_name = "default" 
  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember" 
  engine = "REDIS" 
  passwords = ["password123456789"] 
} 

resource "aws_elasticache_user_group" "example"{ 
  engine = "REDIS" 
  user_group_id = "userGroupId" 
  user_ids = [aws_elasticache_user.default.user_id] 
  lifecycle { ignore_changes = [user_ids] } 
} 

resource "aws_elasticache_user" "example" { 
  user_id = "exampleUserID" 
  user_name = "exampleuser" 
  access_string = "on ~app::* -@all +@read +@hash +@bitmap +@geo -setbit -bitfield -hset -hsetnx -hmset -hincrby -hincrbyfloat -hdel -bitop -geoadd -georadius -georadiusbymember" 
  engine = "REDIS" 
  passwords = ["password123456789"] 
} 

resource "aws_elasticache_user_group_association" "example" { 
  user_group_id = aws_elasticache_user_group.example.user_group_id 
  user_id = aws_elasticache_user.example.user_id 
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Check if AWS ElastiCache user group exists
aws_elasticache_user_group_exists(resources) {
    some resource in resources
    resource.type == "aws_elasticache_user_group"
    resource.change.actions[_] == "create"
}

# Check if AWS ElastiCache user exists
aws_elasticache_user_exists(resources) {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.actions[_] == "create"
}

# Check if AWS ElastiCache user group association is valid
aws_elasticache_user_group_association_valid(resources) {
    aws_elasticache_user_exists(resources)
    aws_elasticache_user_group_exists(resources)

    some resource in resources
    resource.type == "aws_elasticache_user_group_association"
    resource.change.actions[_] == "create"
    user_id := resource.change.after.user_id
    group_id := resource.change.after.user_group_id

    user_id_exists(user_id, resources)
    group_id_exists(group_id, resources)
}

# Helper functions to check if user_id and group_id exist in the resources
user_id_exists(user_id, resources) {
    some resource in resources
    resource.type == "aws_elasticache_user"
    resource.change.after.user_id == user_id
}

group_id_exists(group_id, resources) {
    some resource in resources
    resource.type == "aws_elasticache_user_group"
    resource.change.after.user_group_id == group_id
}

# Aggregate all checks
allow {
    aws_elasticache_user_group_association_valid(input.resource_changes)
}
Task: Create a RedShift cluster resource with a single node

Specification:
Has an aws_redshift_cluster resource and check cluster_type is "single_node" or number of nodes is 1

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "tf-redshift-cluster"
  database_name      = "mydb"
  master_username    = "exampleuser"
  master_password    = "Mustbe8characters"
  node_type          = "dc2.large"
  cluster_type       = "single-node"
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_redshift_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 1
}

# Aggregate all checks
allow {
    aws_redshift_cluster_valid(input.resource_changes)
}
Task: Create a 2 node RedShift cluster and limit the concurrency scaling to 60 minutes

Specification:
Has an aws_redshift_cluster resource and check cluster_type is "single_node" or number of nodes is 2, check there is a aws_redshift_usage_limit resouce where the feature type is concurrency_scaling, limit_type is "time", and amount is 60

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "redshift-cluster-1"
  node_type          = "dc2.large"
  number_of_nodes    = 2

  database_name = "mydb"
  master_username = "foo"
  master_password = "Mustbe8characters"

  skip_final_snapshot = true
}

resource "aws_redshift_usage_limit" "example" {
  cluster_identifier = aws_redshift_cluster.example.id
  feature_type       = "concurrency-scaling"
  limit_type         = "time"
  amount             = 60
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_redshift_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 2
}

aws_redshift_usage_limit_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_usage_limit"
    resource.change.after.feature_type == "concurrency-scaling"
    resource.change.after.limit_type == "time"
    resource.change.after.amount == 60
}

# Aggregate all checks
allow {
    aws_redshift_cluster_valid(input.resource_changes)
    aws_redshift_usage_limit_valid(input.resource_changes)
}
Task: Create a 2 node RedShift cluster and create a new Amazon Redshift endpoint authorization for an account with AWS id 012345678910

Specification:
Has an aws_redshift_resouce with 2 nodes and creates a aws_redshift_endpoint_authorization resource with account =012345678910

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "redshift-cluster-1"
  node_type          = "dc2.large"
  number_of_nodes    = 2

  database_name = "mydb"
  master_username = "foo"
  master_password = "Mustbe8characters"

  skip_final_snapshot = true
}

resource "aws_redshift_endpoint_authorization" "example" {
  account            = "012345678910"
  cluster_identifier = aws_redshift_cluster.example.cluster_identifier
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_redshift_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 2
}

# Function to check if Redshift snapshot schedule is every 12 hours
aws_redshift_endpoint_authorization_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_endpoint_authorization"
    resource.change.after.account == "012345678910"
}

# Aggregate all checks
allow {
    aws_redshift_cluster_valid(input.resource_changes)
    aws_redshift_endpoint_authorization_valid(input.resource_changes)
}
Task: Create a 1 node RedShift cluster and automatically create a snapshot every 12 hours

Specification:
Has an aws_redshift resouce with 1 node and aws_redshift_snapshot_schedule resource with rate set to 12 hours. Then have a aws_redshift_snapshot_schedle_association to conect the 2

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "redshift-cluster-1"
  node_type          = "dc2.large"
  number_of_nodes    = 1

  database_name = "mydb"
  master_username = "foo"
  master_password = "Mustbe8characters"

  skip_final_snapshot = true
}

resource "aws_redshift_snapshot_schedule" "default" {
  identifier = "tf-redshift-snapshot-schedule"
  definitions = [
    "rate(12 hours)",
  ]
}

resource "aws_redshift_snapshot_schedule_association" "default" {
  cluster_identifier  = aws_redshift_cluster.example.id
  schedule_identifier = aws_redshift_snapshot_schedule.default.id
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_redshift_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 1
}

# Function to check if Redshift snapshot schedule is every 12 hours
aws_redshift_snapshot_schedule_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_snapshot_schedule"
    resource.change.after.definitions[_] == "rate(12 hours)"
}

# Aggregate all checks
allow {
    aws_redshift_cluster_valid(input.resource_changes)
    aws_redshift_snapshot_schedule_valid(input.resource_changes)
}
Task: Create a VPC in us-east-1 and create subnets in east-1a and east-1b. Create a RedShift subnet group with a subnet in east-1a and east-1b

Specification:
Create a VPC, create 2 subnets (1 in east1a and 1 in east1b) then create a redshift_subnet_group

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "main-vpc"
  }
}

resource "aws_subnet" "subnet_east_1a" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
  availability_zone = "us-east-1a"

  tags = {
    Name = "subnet-east-1a"
  }
}

resource "aws_subnet" "subnet_east_1b" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.2.0/24"
  availability_zone = "us-east-1b"

  tags = {
    Name = "subnet-east-1b"
  }
}

resource "aws_redshift_subnet_group" "redshift_subnet_group" {
  name       = "my-redshift-subnet-group"
  subnet_ids = [aws_subnet.subnet_east_1a.id, aws_subnet.subnet_east_1b.id]

  tags = {
    Name = "my-redshift-subnet-group"
  }
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

# Function to check if a VPC is created in us-east-1
aws_vpc_valid(resources) {
    some resource in resources
    resource.type == "aws_vpc"
    resource.change.after.cidr_block == "10.0.0.0/16"
}

# Function to check if subnets are created in east-1a and east-1b
aws_subnets_valid(resources) {
    some resource in resources
    resource.type == "aws_subnet"
    resource.change.after.availability_zone in {"us-east-1a", "us-east-1b"}
    resource.change.after.cidr_block == "10.0.1.0/24"
}

# Function to check if a Redshift subnet group is created with subnets in east-1a and east-1b
aws_redshift_subnet_group_valid(root_module_resources) {
    some resource in root_module_resources
    resource.type == "aws_redshift_subnet_group"
    count(resource.expressions.subnet_ids.references) == 4
}

# Aggregate all checks
allow {
    aws_vpc_valid(input.resource_changes)
    aws_subnets_valid(input.resource_changes)
    aws_redshift_subnet_group_valid(input.configuration.root_module.resources)
}
Task: Create an IAM role and a redshift cluster and associate the IAM role with the RedShift cluster.

Specification:
Create a aws_iam_role, aws_redshift_cluster, and attach the role to the cluster

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_role" "redshift_role" {
  name = "redshift_role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = "sts:AssumeRole",
        Effect = "Allow",
        Principal = {
          Service = "redshift.amazonaws.com"
        },
      },
    ],
  })
}

resource "aws_iam_role_policy_attachment" "redshift_s3_read_only" {
  role       = aws_iam_role.redshift_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "tf-redshift-cluster"
  database_name      = "mydb"
  master_username    = "foo"
  master_password    = "Mustbe8characters"
  node_type          = "dc2.large"
  cluster_type       = "single-node"

  depends_on = [aws_iam_role.redshift_role]
}

resource "aws_redshift_cluster_iam_roles" "example" {
  cluster_identifier = aws_redshift_cluster.example.id
  iam_role_arns      = [aws_iam_role.redshift_role.arn]
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_redshift_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 1
}

iam_role_vaild(resources) {
    some resource in resources
    resource.type == "aws_iam_role"
}

aws_iam_role_policy_attachment(resources) {
    some resource in resources
    resource.type == "aws_iam_role_policy_attachment"
}

aws_redshift_cluster_iam_roles_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_cluster_iam_roles"
}

# Aggregate all checks
allow {
    aws_redshift_cluster_valid(input.resource_changes)
    iam_role_vaild(input.resource_changes)
    aws_iam_role_policy_attachment(input.resource_changes)
    aws_redshift_cluster_iam_roles_valid(input.resource_changes)
}
Task: Create a 2-node RedShift cluster and attach a resource policy to it.

Specification:
Create a redshift cluster and a aws_reedshift_resource_poliicy attached to it

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "redshift-cluster-1"
  node_type          = "dc2.large"
  cluster_type       = "multi-node"
  number_of_nodes    = 2

  database_name = "mydb"
  master_username = "foo"
  master_password = "Mustbe8characters"

  skip_final_snapshot = true
}

resource "aws_redshift_resource_policy" "example" {
  resource_arn = aws_redshift_cluster.example.cluster_namespace_arn
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        AWS = "arn:aws:iam::12345678901:root"
      }
      Action   = "redshift:CreateInboundIntegration"
      Resource = aws_redshift_cluster.example.cluster_namespace_arn
      Sid      = ""
    }]
  })
}

Validation policy (checks.rego):
package main

import future.keywords.in

default allow = false

aws_redshift_cluster_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_cluster"
    resource.change.after.number_of_nodes == 2
}

aws_redshift_resource_policy_valid(resources) {
    some resource in resources
    resource.type == "aws_redshift_resource_policy"
}

# Aggregate all checks
allow {
    aws_redshift_cluster_valid(input.resource_changes)
    aws_redshift_resource_policy_valid(input.resource_changes)
}