znyang/ambig-iac huggingface dataset:
Task: Configure a Route 53 record with an Elastic Load Balancer resource. Call the zone "primary" and the elb "main"

Specification:
Has one "aws_route53_zone" resource
    with "name"

Has a "aws_elb" resource
    with "name"
    with "availability_zones"
    with a "listener" block with "instance_port", "instance_protocol", "lb_port", "lb_protocol"

Has a "aws_route53_record" resource
    with "name"
    with "type"
    with "ttl"
    with "zone_id" referencing the "aws_route53_zone" resource
    with an "alias" block with "name" and "zone_id" referencing the "aws_elb" and "evaluate_target_health" equal to true




Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_route53_zone" "primary" {
  name = "example53.com"
}

resource "aws_elb" "main" {
  name               = "sample"
  availability_zones = ["us-east-1c"]

  listener {
    instance_port     = 80
    instance_protocol = "http"
    lb_port           = 80
    lb_protocol       = "http"
  }
}

resource "aws_route53_record" "www" {
  zone_id = aws_route53_zone.primary.zone_id
  name    = "example53.com"
  type    = "A"

  alias {
    name                   = aws_elb.main.dns_name
    zone_id                = aws_elb.main.zone_id
    evaluate_target_health = true
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_r53_zone = false

default is_valid_r53_record = false

default is_valid_elb = false



# Validate aws_route53_zone resource
is_valid_r53_zone {
        some i
        resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_zone"
    resource.expressions.name

}

is_valid_elb {
        some i
        resource := input.configuration.root_module.resources[i]
    resource.type == "aws_elb"
    resource.expressions.availability_zones
    resource.expressions.listener[0]

}

is_valid_r53_record {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_record"
    resource.expressions.name
    resource.expressions.type
    resource.expressions.zone_id.references[0] == "aws_route53_zone.primary.zone_id"
    resource.expressions.alias[0].name.references[0] == "aws_elb.main.dns_name"
    resource.expressions.alias[0].zone_id.references[0] == "aws_elb.main.zone_id"
}




# Combine all checks into a final rule
is_configuration_valid {
    is_valid_r53_zone
    is_valid_elb
    is_valid_r53_record
}
Task: Set up a record that maps a domain name to an IPv4 address using Route 53 resources

Specification:
Has one "aws_route53_zone" resource
    with "name" set to "example53.com"

Has one "aws_route53_record" resource
    with "name"
    with "type" set to "A"
    with "ttl"
    with "records"
    with "zone_id" referencing the "aws_route53_zone" resource


Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_route53_zone" "example53" {
  name = "example53.com"
}

resource "aws_route53_record" "example53_A" {
  zone_id = aws_route53_zone.example53.zone_id
  name    = "example53.com"
  type    = "A"
  ttl     = "300"
  records = ["192.0.2.1"]  
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_r53_zone = false

default is_valid_r53_record = false

# Validate aws_route53_zone resource
is_valid_r53_zone {
        some i
        resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_zone"
    resource.expressions.name.constant_value == "example53.com"
}

# Validate aws_route53_record
is_valid_r53_record {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_record"
    resource.expressions.name
    resource.expressions.type.constant_value == "A"
    resource.expressions.ttl
    resource.expressions.records
    resource.expressions.zone_id.references[0] == "aws_route53_zone.example53.zone_id"
}


# Combine all checks into a final rule
is_configuration_valid {
    is_valid_r53_zone
    is_valid_r53_record
}
Task: Set up a record that maps a domain name to an IPv6 address using Route 53 resources

Specification:
Has one "aws_route53_zone" resource
    with "name" set to "example53.com"

Has one "aws_route53_record" resource
    with "name"
    with "type" set to "AAAA"
    with "ttl"
    with "records"
    with "zone_id" referencing the "aws_route53_zone" resource


Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_route53_zone" "example53" {
  name = "example53.com"
}

resource "aws_route53_record" "example53_A" {
  zone_id = aws_route53_zone.example53.zone_id
  name    = "example53.com"
  type    = "AAAA"
  ttl     = "300"
  records = ["2001:0db8:85a3:0000:0000:8a2e:0370:7334"]  
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_r53_zone = false

default is_valid_r53_record = false

# Validate aws_route53_zone resource
is_valid_r53_zone {
        some i
        resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_zone"
    resource.expressions.name.constant_value == "example53.com"
}

# Validate aws_route53_record
is_valid_r53_record {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_record"
    resource.expressions.name
    resource.expressions.type.constant_value == "AAAA"
    resource.expressions.ttl
    resource.expressions.records
    resource.expressions.zone_id.references[0] == "aws_route53_zone.example53.zone_id"
}


# Combine all checks into a final rule
is_configuration_valid {
    is_valid_r53_zone
    is_valid_r53_record
}
Task: Set up a Pointer record for reverse DNS using Route 53 resources. The domain name should be "host.example53.com" and name the zone "reverse_zone"

Specification:
Has one "aws_route53_zone" resource
    with "name" ending in ".in-addr.arpa"

Has one "aws_route53_record" resource
    with "name"
    with "type" set to "PTR"
    with "ttl"
    with "records"
    with "zone_id" referencing the "aws_route53_zone" resource


Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

# Create Reverse DNS Hosted Zone
resource "aws_route53_zone" "reverse_zone" {
  name = "2.0.192.in-addr.arpa"
}

# Create a PTR Record for a specific IP address within that zone
resource "aws_route53_record" "ptr_record" {
  zone_id = aws_route53_zone.reverse_zone.zone_id
  name    = "53.2.0.192.in-addr.arpa"
  type    = "PTR"
  ttl     = "3600"
  records = ["host.example.com"]
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_r53_zone = false

default is_valid_r53_record = false

# Validate aws_route53_zone resource
is_valid_r53_zone {
        some i
        resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_zone"
    resource.expressions.name.constant_value == "2.0.192.in-addr.arpa"
}

# Validate aws_route53_record
is_valid_r53_record {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_record"
    resource.expressions.name
    resource.expressions.type.constant_value == "PTR"
    resource.expressions.ttl
    resource.expressions.records.constant_value[0] == "host.example.com"
    resource.expressions.zone_id.references[0] == "aws_route53_zone.reverse_zone.zone_id"
}


# Combine all checks into a final rule
is_configuration_valid {
    is_valid_r53_zone
    is_valid_r53_record
}
Task: Set up a TXT recordfor domain ownership verification purposes using Route 53 resources. The verification string should be "passwordpassword" and the name of the zone should be "example"

Specification:
Has one "aws_route53_zone" resource
    with "name" set to "example53.com"

Has one "aws_route53_record" resource
    with "name"
    with "type" set to "TXT"
    with "ttl"
    with "records" set to a string
    with "zone_id" referencing the "aws_route53_zone" resource


Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_route53_zone" "example" {
  name = "example53.com"
}

# TXT Record for domain verification or other purposes
resource "aws_route53_record" "example_txt" {
  zone_id = aws_route53_zone.example.zone_id
  name    = "sub.example53.com"
  type    = "TXT"
  ttl     = "300"
  records = ["passwordpassword"] 
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_r53_zone = false

default is_valid_r53_record = false

# Validate aws_route53_zone resource
is_valid_r53_zone {
        some i
        resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_zone"
    resource.expressions.name.constant_value == "example53.com"
}

# Validate aws_route53_record
is_valid_r53_record {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_route53_record"
    resource.expressions.name
    resource.expressions.type.constant_value == "TXT"
    resource.expressions.ttl
    resource.expressions.records.constant_value[0] == "passwordpassword"
    resource.expressions.zone_id.references[0] == "aws_route53_zone.example.zone_id"
}


# Combine all checks into a final rule
is_configuration_valid {
    is_valid_r53_zone
    is_valid_r53_record
}
Task: Create a template of an elastic beanstalk application

Specification:
Has one "aws_elastic_beanstalk_application" resource
    with "name"

Has one "aws_elastic_beanstalk_configuration_template" resource
    with "name"
    with "application" referencing the "aws_elastic_beanstalk_application" resource
    with "solution_stack_name" 

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_elastic_beanstalk_application" "tftest" {
  name        = "tf-test-name"
  description = "tf-test-desc"
}

resource "aws_elastic_beanstalk_configuration_template" "tf_template" {
  name                = "tf-test-template-config"
  application         = aws_elastic_beanstalk_application.tftest.name
  solution_stack_name = "64bit Amazon Linux 2023 v4.0.9 running Python 3.11"
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_eb_app = false

default is_valid_eb_app_template = false


is_valid_eb_app {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_elastic_beanstalk_application"
    resource.expressions.name
}



is_valid_eb_app_template {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_elastic_beanstalk_configuration_template"
    resource.expressions.name
    resource.expressions.solution_stack_name
    startswith(resource.expressions.application.references[0], "aws_elastic_beanstalk_application")
}


is_configuration_valid {
    is_valid_eb_app
    is_valid_eb_app_template
}
Task: Create a template of an elastic beanstalk application that is running a version of Go

Specification:
Has one "aws_elastic_beanstalk_application" resource
    with "name"

Has one "aws_elastic_beanstalk_configuration_template" resource
    with "name"
    with "application" referencing the "aws_elastic_beanstalk_application" resource
    with "solution_stack_name" that references a valid "Go" version

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_elastic_beanstalk_application" "tftest" {
  name        = "tf-test-name"
  description = "tf-test-desc"
}

resource "aws_elastic_beanstalk_configuration_template" "tf_template" {
  name                = "tf-test-template-config"
  application         = aws_elastic_beanstalk_application.tftest.name
  solution_stack_name = "64bit Amazon Linux 2 v3.10.1 running Go 1"
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_eb_app = false

default is_valid_eb_app_template = false


is_valid_eb_app {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_elastic_beanstalk_application"
    resource.expressions.name
}



is_valid_eb_app_template {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_elastic_beanstalk_configuration_template"
    resource.expressions.name
    endswith(resource.expressions.solution_stack_name.constant_value, "Go 1")
    startswith(resource.expressions.application.references[0], "aws_elastic_beanstalk_application")
}


is_configuration_valid {
    is_valid_eb_app
    is_valid_eb_app_template
}
Task: Provision a resource to deploy and scale a web application that was developed with supported programming languages.

Specification:
Has one "aws_elastic_beanstalk_application" resource
    with "name"

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_elastic_beanstalk_application" "tftest" {
  name        = "tf-test-name"
  description = "tf-test-desc"
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_eb_app = false


is_valid_eb_app {
        some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_elastic_beanstalk_application"
    resource.expressions.name
}


is_configuration_valid {
    is_valid_eb_app
}
Task: Create an Elastic Beanstalk application with an app version lifecycle

Specification:
Has one "aws_elastic_beanstalk_application" resource
    with "name"
    with "appversion_lifecycle" block

Has one "aws_iam_role" resource
    with "name"
    with "assume_role_policy" and "Service" set to "elasticbeanstalk.amazonaws.com"

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_role" "beanstalk_service" {
  name = "tf-test-beanstalk-service-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = "sts:AssumeRole",
        Effect = "Allow",
        Principal = {
          Service = "elasticbeanstalk.amazonaws.com"
        },
      },
    ]
  })
}

resource "aws_elastic_beanstalk_application" "tftest" {
  name        = "tf-test-name"
  description = "tf-test-desc"

  appversion_lifecycle {
    service_role          = aws_iam_role.beanstalk_service.arn
    max_count             = 128
    delete_source_from_s3 = true
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_eb_app = false

default is_valid_iam_role = false



is_valid_eb_app {
        some i 
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_elastic_beanstalk_application"
    resource.expressions.name
    resource.expressions.appversion_lifecycle[0].service_role.references[0]
}

is_valid_iam_role {
        some i
    resource := input.resource_changes[i]
    resource.type == "aws_iam_role"
    contains(resource.change.after.assume_role_policy,"elasticbeanstalk.amazonaws.com")
}


is_configuration_valid {
    is_valid_eb_app
    is_valid_iam_role
}
Task: Create an Elastic Beanstalk application with an app version lifecycle. Retain the version for 5 days

Specification:
Has one "aws_elastic_beanstalk_application" resource
    with "name"
    with "appversion_lifecycle" block

Has one "aws_iam_role" resource
    with "name"
    with "assume_role_policy" and "Service" set to "elasticbeanstalk.amazonaws.com"

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_iam_role" "beanstalk_service" {
  name = "tf-test-beanstalk-service-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = "sts:AssumeRole",
        Effect = "Allow",
        Principal = {
          Service = "elasticbeanstalk.amazonaws.com"
        },
      },
    ]
  })
}

resource "aws_elastic_beanstalk_application" "tftest" {
  name        = "tf-test-name"
  description = "tf-test-desc"

  appversion_lifecycle {
    service_role          = aws_iam_role.beanstalk_service.arn
    max_age_in_days = 5
    delete_source_from_s3 = true
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_configuration_valid = false

default is_valid_eb_app = false

default is_valid_iam_role = false



is_valid_eb_app {
        some i 
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_elastic_beanstalk_application"
    resource.expressions.name
    resource.expressions.appversion_lifecycle[0].service_role.references[0]
    resource.expressions.appversion_lifecycle[0].max_age_in_days.constant_value == 5

}
is_valid_iam_role {
        some i
    resource := input.resource_changes[i]
    resource.type == "aws_iam_role"
    contains(resource.change.after.assume_role_policy,"elasticbeanstalk.amazonaws.com")
}


is_configuration_valid {
    is_valid_eb_app
    is_valid_iam_role
}
Task: create a Basic AWS codebuild project resource with example iam role and an example GITHUB source

Specification:
Has one "aws_iam_role" resource and one "aws_codebuild_project" resource with the "type" argument within the "source" block equal to "GITHUB"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region  = "us-east-1"
}

data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["codebuild.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "test_role" {
  name               = "test_role"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}


resource "aws_codebuild_project" "example" {
  name          = "test-project"
  service_role  = aws_iam_role.test_role.arn

  artifacts {
    type = "NO_ARTIFACTS"
  }

  environment {
    compute_type = "BUILD_GENERAL1_SMALL"
    image        = "aws/codebuild/standard:7.0-24.10.29"
    type         = "LINUX_CONTAINER"
  }

  source {
    type            = "GITHUB"
    location        = "github.com/source-location"
    git_clone_depth = 1
  }
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

# Rule for aws_iam_role resource
has_valid_iam_role(resources) { 
        some resource in resources 
    resource.type == "aws_iam_role" 
    contains(resource.change.after.assume_role_policy,"codebuild.amazonaws.com") 
} 

has_valid_codebuild {
        some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_codebuild_project"
        resource.values.artifacts
    resource.values.environment
    resource.values.name
    resource.values.source[_].type == "GITHUB"
    role := input.configuration.root_module.resources[i]
    role.expressions.service_role
}

has_valid_resources {
        has_valid_iam_role(input.resource_changes)
    has_valid_codebuild
}
Task: create a AWS codebuild project resource with example iam role, an example GITHUB source, environment variables, and a cache

Specification:
Has one "aws_iam_role" resource, one "aws_s3_bucket" resource, and one "aws_codebuild_project" resource with a "cache" block, at least one "environment_variable" within the "environment" block, and the "type" argument within the "source" block equal to "GITHUB"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region  = "us-east-1"
}


resource "aws_iam_role" "example" {
  name = "example"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Service = "codebuild.amazonaws.com"
        }
      },
    ]
  })
}

resource "aws_codebuild_project" "example" {
  name          = "Row2CodeBuild"
  description   = "Row2CodeBuild"
  build_timeout = 5
  service_role  = aws_iam_role.example.arn

  artifacts {
    type = "NO_ARTIFACTS"
  }

  cache {
    type  = "LOCAL"
    modes = ["LOCAL_DOCKER_LAYER_CACHE", "LOCAL_SOURCE_CACHE"]
  }

  environment {
    compute_type                = "BUILD_GENERAL1_SMALL"
    image                       = "aws/codebuild/standard:7.0-24.10.29"
    type                        = "LINUX_CONTAINER"
    image_pull_credentials_type = "CODEBUILD"

    environment_variable {
      name  = "SOME_KEY1"
      value = "SOME_VALUE1"
    }

    environment_variable {
      name  = "SOME_KEY2"
      value = "SOME_VALUE2"
      type  = "PARAMETER_STORE"
    }
  }

  source {
    type            = "GITHUB"
    location        = "https://github.com/mitchellh/packer.git"
    git_clone_depth = 1

    git_submodules_config {
      fetch_submodules = true
    }
  }

  source_version = "master"
}

Validation policy (checks.rego):
package terraform.validation

import future.keywords.in

default has_valid_resources = false

# Rule for aws_iam_role resource
has_valid_iam_role(resources) { 
        some resource in resources 
    resource.type == "aws_iam_role" 
    contains(resource.change.after.assume_role_policy,"codebuild.amazonaws.com") 
} 

has_valid_bucket {
        some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_s3_bucket"
    
}

has_valid_codebuild {
        some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_codebuild_project"
        resource.values.artifacts
    resource.values.environment[_].environment_variable
    resource.values.cache
    resource.values.name
    resource.values.source[_].type == "GITHUB"
    role := input.configuration.root_module.resources[i]
    role.expressions.service_role
}

has_valid_resources {
        has_valid_iam_role(input.resource_changes)
    has_valid_codebuild
}