Task: Configure a health check with route 53 that uses a cloudwatch metric alarm called "foobar". Set the metric_name to "CPUUtilization", namespace to "AWS/EC2", statistic to "Average", period to "120", and comparison_operator to "GreaterThanOrEqualToThreshold". If the health check doesn't have enough info about the alarm, the status should be "Healthy". All resources should be provisioned in "us-east-1"

Specification:
Has one "aws_cloudwatch_metric_alarm"" resources
    with "alarm_name"
    with "comparison_operator" set to "GreaterThanOrEqualToThreshold"
    with "evaluation_periods"
    with "namespace" set to "AWS/EC2"
    with "period" set to "120"
    with "statistic" set to "Average"
    with "metric_name" set to "CPUUtilization"
    with "threshold"

Has one "aws_route53_health_check" resources
    with "cloudwatch_alarm_name" referencing the "aws_cloudwatch_metric_alarm" resource
    with "cloudwatch_alarm_region" 
    with "insufficient_data_health_status" set to "Healthy"
    with "type" equal to "CLOUDWATCH"



Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1" 
}

resource "aws_cloudwatch_metric_alarm" "foobar" {
  alarm_name          = "terraform-test-foobar5"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = "2"
  metric_name         = "CPUUtilization"
  namespace           = "AWS/EC2"
  period              = "120"
  statistic           = "Average"
  threshold           = "80"
  alarm_description   = "This metric monitors ec2 cpu utilization"
}

resource "aws_route53_health_check" "foo" {
  type                            = "CLOUDWATCH_METRIC"
  cloudwatch_alarm_name           = aws_cloudwatch_metric_alarm.foobar.alarm_name
  cloudwatch_alarm_region         = "us-east-1"
  insufficient_data_health_status = "Healthy"
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_r53_health_check = false

default is_valid_cloud_watch_alarm = false


# Validate aws_route53_health_check
is_valid_r53_health_check {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_health_check"
    resource.expressions.type.constant_value == "CLOUDWATCH_METRIC"
    resource.expressions.cloudwatch_alarm_name.references[0] == "aws_cloudwatch_metric_alarm.foobar.alarm_name"
    resource.expressions.cloudwatch_alarm_region.constant_value == "us-east-1"
    resource.expressions.insufficient_data_health_status.constant_value = "Healthy"
}

is_valid_cloud_watch_alarm {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_cloudwatch_metric_alarm"
    resource.expressions.alarm_name
    resource.expressions.comparison_operator.constant_value == "GreaterThanOrEqualToThreshold"
    resource.expressions.evaluation_periods
    resource.expressions.metric_name.constant_value == "CPUUtilization"
    resource.expressions.namespace.constant_value == "AWS/EC2"
    resource.expressions.period.constant_value == "120"
    resource.expressions.statistic.constant_value == "Average"
    resource.expressions.threshold
}
 


# Combine all checks into a final rule
is_configuration_valid {
    is_valid_r53_health_check
    is_valid_cloud_watch_alarm
}