znyang/ambig-iac huggingface dataset:
Task: Set up a non-alias aws_route_53 record that is linked to an aws_route53_zone resource called "private_zone" whose name paramter is set to "internal.example53.com" and has an aws_vpc resource called "main" attached to it

Specification:
Has one "aws_vpc" resource
    with a specified "cidr_block"

Has one "aws_route53_zone" resource
    with "name" set to "internal.example53.com"
    with a "vpc" block that contains "vpc_id" that references the "aws_vpc" resource

Has one "aws_route53_record" resource
    with "name"
    with "type"
    with "ttl"
    with "records"
    with "zone_id" referencing the "aws_route53_zone" resource

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1" 
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  tags = {
    Name = "main-vpc"
  }
}

resource "aws_route53_zone" "private_zone" {
  name = "internal.example53.com" 

  vpc {
    vpc_id = aws_vpc.main.id  
    }
}


resource "aws_route53_record" "internal_record" {
  zone_id = aws_route53_zone.private_zone.zone_id
  name    = "api.internal.example53.com"
  type    = "A"
  ttl     = "300"
  records = ["10.0.1.101"]  
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_r53_zone = false

default is_valid_r53_record = false

default is_valid_vpc = false

# Validate aws_vpc resource
is_valid_vpc {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_vpc"
        resource.expressions.cidr_block != null
}


# Validate aws_route53_zone resource
is_valid_r53_zone {
	some i
	resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_zone"
    resource.expressions.name.constant_value == "internal.example53.com"
    resource.expressions.vpc[0].vpc_id.references[0] == "aws_vpc.main.id"
}

# Validate aws_route53_record
is_valid_r53_record {
	some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_record"
    resource.expressions.name
    resource.expressions.type
    resource.expressions.ttl
    resource.expressions.records
    resource.expressions.zone_id.references[0] == "aws_route53_zone.private_zone.zone_id"
}


# Combine all checks into a final rule
is_configuration_valid {
	is_valid_vpc
    is_valid_r53_zone
    is_valid_r53_record
}
Task: route 53 traffic policy

Specification:
Has one "aws_route53_traffic_policy" resource
    with "name"

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}


resource "aws_route53_traffic_policy" "example" {
  name     = "example"
  comment  = "example comment"
  document = <<EOF
{
  "AWSPolicyFormatVersion": "2015-10-01",
  "RecordType": "A",
  "Endpoints": {
    "endpoint-start-NkPh": {
      "Type": "value",
      "Value": "10.0.0.2"
    }
  },
  "StartEndpoint": "endpoint-start-NkPh"
}
EOF
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_r53_traffic_policy = false



# Validate aws_route53_zone resource
is_valid_r53_traffic_policy {
        some i
    resource := input.configuration.root_module.resources[i]
  	resource.type == "aws_route53_traffic_policy"
    resource.expressions.name
    resource.expressions.comment
    resource.expressions.document

}



# Combine all checks into a final rule
is_configuration_valid {
    is_valid_r53_traffic_policy
}
Task: Create a Terraform script for an AWS EKS access entry with name "example". Define a resource to grant access to an EKS cluster using the cluster's name and a principal's ARN. Include assigning specific Kubernetes groups and set the access type to 'STANDARD'.

Specification:
has one "aws_eks_access_entry" resource
with one "cluster_name"
with one "principal_arn"
with one "kubernetes_groups"
with one "type"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "private-us-east-1a" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_iam_role" "example" {
  name = "eks-cluster-1"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example.name
}

resource "aws_eks_cluster" "example" {
  name     = "test"
  version  = "test-version"
  role_arn = aws_iam_role.example.arn

  vpc_config {
    subnet_ids = [
      aws_subnet.private-us-east-1a.id,
    ]
  }
}

resource "aws_eks_access_entry" "example" {
  cluster_name      = aws_eks_cluster.example.name
  principal_arn     = aws_iam_role.example.arn
  kubernetes_groups = ["group-1", "group-2"]
  type              = "STANDARD"
}

Validation policy (checks.rego):
package terraform.validation

default has_aws_eks_access_entry_example = false

has_aws_eks_access_entry_example {
    entry := input.planned_values.root_module.resources[_]
    entry.type == "aws_eks_access_entry"
    entry.name == "example"
    entry.values.cluster_name == input.planned_values.root_module.resources[_].values.name  # Ensures it's the correct reference to aws_eks_cluster.example
    entry.values.kubernetes_groups == ["group-1", "group-2"]
    entry.values.type == "STANDARD"
}
Task: Create a Terraform script to associate an access policy with name "example", with an AWS EKS cluster. Define a resource linking the cluster's name to a specific policy ARN and a principal's ARN. Include settings for an access scope limited to a specific namespace.

Specification:
has one "aws_eks_access_policy_association" resource
with one "cluster_name"
with one "policy_arn"
with one "principal_arn"
with one "access_scope"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "private-us-east-1a" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_iam_role" "example" {
  name = "eks-cluster-1"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example.name
}

resource "aws_eks_cluster" "example" {
  name     = "test"
  version  = "test-version"
  role_arn = aws_iam_role.example.arn

  vpc_config {
    subnet_ids = [
      aws_subnet.private-us-east-1a.id,
    ]
  }
}

resource "aws_iam_user" "example" {
  name = "eks-test"
}

resource "aws_eks_access_policy_association" "example" {
  cluster_name  = aws_eks_cluster.example.name
  policy_arn    = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy"
  principal_arn = aws_iam_user.example.arn

  access_scope {
    type       = "namespace"
    namespaces = ["example-namespace"]
  }
}

Validation policy (checks.rego):
package terraform.validation

default has_aws_eks_access_policy_association_example = false

has_aws_eks_access_policy_association_example {
    policy_assoc := input.planned_values.root_module.resources[_]
    policy_assoc.type == "aws_eks_access_policy_association"
    policy_assoc.name == "example"
    policy_assoc.values.cluster_name == input.planned_values.root_module.resources[_].values.name  # Ensures it references aws_eks_cluster.example
    policy_assoc.values.policy_arn == "arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy"
    policy_assoc.values.access_scope[_].type == "namespace"
    policy_assoc.values.access_scope[_].namespaces == ["example-namespace"]
}
Task: Generate a Terraform script to add an addon with name "example", to an AWS EKS cluster. Define a resource that specifies the cluster's name and sets the addon name to 'vpc-cni'.

Specification:
has one "aws_eks_addon" resource
with one "cluster_name"
with one "addon_name"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "private-us-east-1a" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_iam_role" "example" {
  name = "eks-cluster-1"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example.name
}

resource "aws_eks_cluster" "example" {
  name     = "test"
  version  = "test-version"
  role_arn = aws_iam_role.example.arn

  vpc_config {
    subnet_ids = [
      aws_subnet.private-us-east-1a.id,
    ]
  }
}

resource "aws_eks_addon" "example" {
  cluster_name = aws_eks_cluster.example.name
  addon_name   = "vpc-cni"
}

Validation policy (checks.rego):
package terraform.validation

default has_aws_eks_addon_example = false

has_aws_eks_addon_example {
    addon := input.planned_values.root_module.resources[_]
    addon.type == "aws_eks_addon"
    addon.name == "example"
    addon.values.cluster_name == input.planned_values.root_module.resources[_].values.name  # Ensures it references aws_eks_cluster.example correctly
    addon.values.addon_name == "vpc-cni"
}
Task: Create a Terraform script for an AWS IAM role designed for EKS Fargate profiles. Define a role with a specific name (with the name attribute set to "eks-fargate-profile-example") and an assume role policy that allows actions from 'eks-fargate-pods.amazonaws.com'. Also, attach a predefined Amazon EKS Fargate Pod Execution Role Policy to this role.

Specification:
has one "aws_iam_role" resource
with one "name"
with one "assume_role_policy"

has one "aws_iam_role_policy_attachment" resource
with one "policy_arn"
with one "role"

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_role" "example" {
  name = "eks-fargate-profile-example"

  assume_role_policy = jsonencode({
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Service = "eks-fargate-pods.amazonaws.com"
      }
    }]
    Version = "2012-10-17"
  })
}

resource "aws_iam_role_policy_attachment" "example-AmazonEKSFargatePodExecutionRolePolicy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
  role       = aws_iam_role.example.name
}

Validation policy (checks.rego):
package terraform.validation

default has_aws_iam_role_example = false
default has_aws_iam_role_policy_attachment_example = false

has_aws_iam_role_example {
    role := input.planned_values.root_module.resources[_]
    role.type == "aws_iam_role"
    role.values.name == "eks-fargate-profile-example"
    # Ensure the assume role policy is correctly configured
    role.values.assume_role_policy == "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"eks-fargate-pods.amazonaws.com\"}}],\"Version\":\"2012-10-17\"}"
}

has_aws_iam_role_policy_attachment_example {
    attachment := input.planned_values.root_module.resources[_]
    attachment.type == "aws_iam_role_policy_attachment"
    attachment.name == "example-AmazonEKSFargatePodExecutionRolePolicy"
    attachment.values.policy_arn == "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
    # Check if the role is correctly referenced
    attachment.values.role == input.planned_values.root_module.resources[_].values.name
}

valid_configuration {
    has_aws_iam_role_example
    has_aws_iam_role_policy_attachment_example
}
Task: Generate a Terraform script to configure an OIDC identity provider for an AWS EKS cluster (where the cluster has it's name attribute set to "example"). Define a resource that links to the cluster by name and sets up OIDC with specific parameters including client ID, identity provider config name, and issuer URL.

Specification:
has one "aws_eks_identity_provider_config" resource
with one "cluster_name"
with one "oidc" block containing:
one "client_id"
one "identity_provider_config_name"
one "issuer_url"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "example1" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_subnet" "example2" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.0.2.0/24"
}

resource "aws_iam_role" "example" {
  name = "eks-cluster-1"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.example.name
}

resource "aws_iam_role_policy_attachment" "eks_service_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  role       = aws_iam_role.example.name
}

resource "aws_eks_cluster" "example" {
  name     = "example"
  role_arn = aws_iam_role.example.arn

  vpc_config {
    subnet_ids = [aws_subnet.example1.id, aws_subnet.example2.id]
  }
}

resource "aws_eks_identity_provider_config" "example" {
  cluster_name = aws_eks_cluster.example.name

  oidc {
    client_id                     = "your client_id"
    identity_provider_config_name = "example"
    issuer_url                    = "https://www.sampleurl.com"
  }
}

Validation policy (checks.rego):
package terraform.validation

default has_aws_eks_identity_provider_config_example = false

has_aws_eks_identity_provider_config_example {
    identity_provider_config := input.planned_values.root_module.resources[_]
    identity_provider_config.type == "aws_eks_identity_provider_config"
    identity_provider_config.values.cluster_name == input.planned_values.root_module.resources[_].values.name
    
    # Check OIDC configuration
    identity_provider_config.values.oidc[_].client_id != null
    identity_provider_config.values.oidc[_].identity_provider_config_name != null
    identity_provider_config.values.oidc[_].issuer_url != null
}
Task: Create an AWS S3 bucket named 'my_bucket' and define an S3 bucket policy to deny access from a specific IP address. Ensure that the S3 bucket policy includes a version number, an identifier, and a statement that denies all S3 actions for the specified IP address. Use the 'jsonencode' function to encode the policy in JSON format.

Specification:
has one "aws_s3_bucket" resource
    with one "bucket"

has one "aws_s3_bucket_policy"
     with one "bucket"
     with one "policy"

Terraform configuration (main.tf):
provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "a" {
  bucket = "test_bucket"
}

resource "aws_s3_bucket_policy" "b" {
  bucket = aws_s3_bucket.a.id
  policy = jsonencode({
    "Version" : "2012-10-17",
    "Id"      : "my_policy",
    "Statement" : [
      {
        "Sid"       : "IPAllow",
        "Effect"    : "Deny",
        "Principal" : "*",
        "Action"    : "s3:*",
        "Resource"  : "arn:aws:s3:::test_bucket/*",
        "Condition" : {
          "IpAddress" : { "aws:SourceIp" : "1.2.3.4/32" }
        }
      }
    ]
  })
}

Validation policy (checks.rego):
package terraform.validation

default valid_configuration = false
default has_s3_bucket = false
default has_s3_bucket_policy = false


# Check for if any aws_s3_bucket with "bucket"
has_s3_bucket {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_s3_bucket"
    resource.expressions.bucket.constant_value != null
}

# Check for if any aws_s3_bucket_policy with "bucket" "policy"
has_s3_bucket_policy{
        resource := input.configuration.root_module.resources[_]
    resource.type == "aws_s3_bucket_policy"
    resource.expressions.bucket.references != null
    has_policy(resource.name)
}

has_policy(policy_name){
        resource := input.configuration.root_module.resources[_]
    resource.type == "aws_s3_bucket_policy"
    resource.name == policy_name
    resource.expressions.policy != null
}

valid_configuration{
        has_s3_bucket
    has_s3_bucket_policy
}
Task: Create a bucket "sample". Implement versioning resource for the AWS S3 bucket named 'sample' with the versioning status set to 'Enabled' and specify the expected_bucket_owner as '123456789012' to ensure ownership consistency.

Specification:
has one aws_s3_bucket resource
with bucket

has one "aws_s3_bucket_versioning" resource
     with bucket
     with versionaning_configuration
          with status

Terraform configuration (main.tf):
provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "sample" {
  bucket = "sample"
}

resource "aws_s3_bucket_versioning" "sample" {
  bucket = "sample"
  versioning_configuration {
    status = "Enabled"
  }
  expected_bucket_owner = "123456789012"
}

Validation policy (checks.rego):
package terraform.validation

default has_s3_bucket_versioning = false

default has_s3_bucket = false

default valid_configuration = false

has_s3_bucket {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_s3_bucket"
    resource.name == "sample"
}

has_s3_bucket_versioning {
    versioning := input.planned_values.root_module.resources[_]
    versioning.type == "aws_s3_bucket_versioning"
    versioning.values.bucket == "sample"
    versioning.values.expected_bucket_owner == "123456789012"
    versioning.values.versioning_configuration[_].status == "Enabled"

}

valid_configuration {
        has_s3_bucket
    has_s3_bucket_versioning
}
Task: create a bucket 'pike-680235478471'. Set up request payment configuration for an AWS S3 bucket named 'pike-680235478471', specifying the payer as 'Requester'.

Specification:
has one aws_s3_bucket resource
with bucket

has one aws_s3_bucket_request_payment_configuration resource
with bucket
with payer (BucketOwner or Requester)

Terraform configuration (main.tf):
provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "a" {
  bucket = "pike-680235478471"
}

resource "aws_s3_bucket_request_payment_configuration" "pike" {
  bucket = "pike-680235478471"
  payer  = "Requester"
}

Validation policy (checks.rego):
package terraform.validation

default has_s3_bucket = false

default has_s3_bucket_request_payment_configuration = false

default valid_configuration = false

has_s3_bucket {
    some i
    bucket := input.planned_values.root_module.resources[i]
    bucket.type == "aws_s3_bucket"
    bucket.values.bucket == "pike-680235478471"
}

has_s3_bucket_request_payment_configuration {
    some i
    payment_config := input.planned_values.root_module.resources[i]
    payment_config.type == "aws_s3_bucket_request_payment_configuration"
    payment_config.values.bucket == "pike-680235478471"
    payment_config.values.payer == "Requester"
}

valid_configuration {
    has_s3_bucket
    has_s3_bucket_request_payment_configuration
}
Task: Implement public access block settings for an AWS S3 bucket named 'pike-680235478471' to block public ACLs, public policies, and restrict public buckets.

Specification:
has one aws_s3_bucket resource
with bucket

has one aws_s3_bucket_public_access_block resource
with bucket
with block_public_acls (boolean)
with block_public_policy (boolean)
with ignore_public_acls (boolean)
with restrict_public_buckets (boolean)

Terraform configuration (main.tf):
provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket" "a" {
  bucket = "pike-680235478471"
}

resource "aws_s3_bucket_public_access_block" "example" {
  bucket = "pike-680235478471"

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

Validation policy (checks.rego):
package terraform.validation

default has_s3_bucket = false

default has_s3_bucket_public_access_block = false

default valid_configuration = false

has_s3_bucket {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_s3_bucket"
    resource.values.bucket == "pike-680235478471"
}

has_s3_bucket_public_access_block {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_s3_bucket_public_access_block"
    resource.values.bucket ==  "pike-680235478471"
    resource.values.block_public_acls == true
    resource.values.block_public_policy == true
    resource.values.ignore_public_acls == true
    resource.values.restrict_public_buckets == true

}


valid_configuration {
    has_s3_bucket
    has_s3_bucket_public_access_block
}
Task: Craft a Terraform configuration for creating an AWS S3 bucket object. Define an S3 bucket object (with value "object") with specific attributes including the bucket name (with value "your_bucket_name"), object key (with value "new_object_key"), and the path to the source file (with value "path/to/file").

Specification:
Resource "aws_s3_bucket_object"
has one "bucket"
has one "key"
has one "source"
has one "etag"

Terraform configuration (main.tf):
provider "aws" {
    region = "us-west-1"
}

resource "aws_s3_bucket_object" "object" {
  bucket = "your_bucket_name"
  key    = "new_object_key"
  source = "path/to/file"
}

Validation policy (checks.rego):
package terraform.validation

default has_aws_s3_bucket_object = false

has_aws_s3_bucket_object {
    object := input.planned_values.root_module.resources[_]
    object.type == "aws_s3_bucket_object"
    object.name == "object"
    object.values.bucket == "your_bucket_name"
    object.values.key == "new_object_key"
    object.values.source == "path/to/file"
}

valid_configuration {
    has_aws_s3_bucket_object
}
Task: Create an AWS aws_ami resource for the latest Amazon Linux 2 AMI

Specification:
create aws_ami resource with name = any

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

data "aws_ami" "latest_amazon_linux_2" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-*-x86_64-gp2"]
  }
}

Validation policy (checks.rego):
package terraform

default ami_latest_amazon_linux_2 = false

ami_latest_amazon_linux_2 {
    resource := input.configuration.root_module.resources[_]
    resource.type == "aws_ami"
    resource.name == "latest_amazon_linux_2"
    resource.expressions.filter[_].name.constant_value == "name"
    resource.expressions.filter[_].values.constant_value[_] == "amzn2-ami-hvm-*-x86_64-gp2"
    resource.expressions.most_recent.constant_value == true
    resource.expressions.owners.constant_value[_] == "amazon"
}