Task: Set up a VPC in the AWS region with two subnets in different availability zones, an internet gateway, and a route table for internet access. It also defines a security group to allow access to MySQL and PostgreSQL databases on their default ports from any IP address and creates a database subnet group including both subnets.

Specification:
Has one "aws_vpc" resource:
Includes a "cidr_block" for network configuration

Has two "aws_subnet" resources:
Both subnets are part of the "aws_vpc" resource
Each subnet is located in a different availability zone

Has one "aws_internet_gateway" resource:
Attached to the "aws_vpc" resource

Has one "aws_route_table" resource:
Associated with the "aws_vpc"
Contains a default route that directs traffic to the "aws_internet_gateway"
Applied to both subnets to enable internet access

Has one "aws_security_group" resource:
Associated with the "aws_vpc"
Configured to allow inbound traffic on the default ports for MySQL (TCP 3306) and PostgreSQL (TCP 5432) from any IP address

Has one "aws_db_subnet_group" resource:
Includes both "aws_subnet" resources
Facilitates the placement of databases in the specified subnets

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region  = "us-east-1"
}

resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
}

data "aws_availability_zones" "azs" {
    state = "available"
}

resource "aws_subnet" "zonea" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = data.aws_availability_zones.azs.names[0]
}

resource "aws_subnet" "zoneb" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = data.aws_availability_zones.azs.names[1]
}

resource "aws_internet_gateway" "gateway" {
  vpc_id = aws_vpc.main.id
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.gateway.id
  }
}

resource "aws_route_table_association" "publica" {
  subnet_id      = aws_subnet.zonea.id
  route_table_id = aws_route_table.public.id
}

resource "aws_route_table_association" "publicb" {
  subnet_id      = aws_subnet.zoneb.id
  route_table_id = aws_route_table.public.id
}

resource "aws_security_group" "allow-db-access" {
  name   = "allow-all"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port   = "3306"
    to_port     = "3306"
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = "5432"
    to_port     = "5432"
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_db_subnet_group" "default" {
  subnet_ids = [aws_subnet.zonea.id, aws_subnet.zoneb.id]
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation states
default is_valid_vpc = false

default is_valid_internet_gateway = false

default is_valid_route_table = false

default is_valid_subnets1 = false

default is_valid_subnets2 = false

default is_valid_security_group = false

default is_valid_db_subnet_group = false

# Validate aws_vpc resource
is_valid_vpc {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_vpc"
        resource.expressions.cidr_block.constant_value != null
}

# Validate aws_subnet resources
is_valid_subnets1 {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_subnet"
        resource.expressions.vpc_id.references[0] == "aws_vpc.main.id"
}

is_valid_subnets2 {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_subnet"
        resource.expressions.vpc_id.references[0] == "aws_vpc.main.id"
}

# Validate aws_internet_gateway resource
is_valid_internet_gateway {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_internet_gateway"
        resource.expressions.vpc_id.references[0] == "aws_vpc.main.id"
}

# Validate aws_route_table resource
is_valid_route_table {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_route_table"
        resource.expressions.vpc_id.references[0] == "aws_vpc.main.id"
        resource.expressions.route.references[0] == "aws_internet_gateway.gateway.id"
}

# Validate aws_security_group resource
is_valid_security_group {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_security_group"
        resource.expressions.vpc_id.references[0] == "aws_vpc.main.id"
    some j
        port1 := resource.expressions.ingress.constant_value[j]
    port1.from_port == 3306
    some k
        port2 := resource.expressions.ingress.constant_value[k]
    port2.from_port == 5432
}

# Validate aws_db_subnet_group resource
is_valid_db_subnet_group {
        some i
        resource := input.configuration.root_module.resources[i]
        resource.type == "aws_db_subnet_group"
}