Task: Create an AWS VPC resource with two AWS subnets. Group these subnets in an AWS Redshift subnet group. Create an example basic AWS Redshift cluster and an AWS Redshift endpoint access with this subnet group attached to the cluster.

Specification:
Has one resource "aws_vpc"

Has one resource "aws_subnet"
with one "vpc_id" with value "aws_vpc.{VPC NAME}.id"

Has another resource "aws_subnet"
with one "vpc_id" with value "aws_vpc.{VPC NAME}.id"

Has one resource "aws_redshift_subnet_group"
with both subnet ids in subnet_ids

Has one resource "aws_redshift_cluster"

Has one resource "aws_redshift_endpoint_access"
with the subnet group referenced in subnet_group_name
and the cluster referenced in cluster_identifier

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_redshift_cluster" "example" {
  cluster_identifier = "tf-redshift-cluster"
  database_name      = "mydb"
  master_username    = "exampleuser"
  master_password    = "Mustbe8characters"
  node_type          = "ra3.xlplus"
  cluster_type       = "single-node"
}

resource "aws_redshift_endpoint_access" "example" {
  endpoint_name      = "example"
  subnet_group_name  = aws_redshift_subnet_group.foobar.id
  cluster_identifier = aws_redshift_cluster.example.cluster_identifier
}

resource "aws_vpc" "foo" {
  cidr_block = "10.1.0.0/16"
}

data "aws_availability_zones" "azs" {
    state = "available"
}

resource "aws_subnet" "foo" {
  cidr_block        = "10.1.1.0/24"
  availability_zone = data.aws_availability_zones.azs.names[0]
  vpc_id            = aws_vpc.foo.id
}

resource "aws_subnet" "bar" {
  cidr_block        = "10.1.2.0/24"
  availability_zone = data.aws_availability_zones.azs.names[1]
  vpc_id            = aws_vpc.foo.id
}

resource "aws_redshift_subnet_group" "foobar" {
  name       = "foo"
  subnet_ids = [aws_subnet.foo.id, aws_subnet.bar.id]
}

Validation policy (checks.rego):
package aws_redshift_endpoint_access
import future.keywords.in

default valid := false

valid {
    some vpc in input.configuration.root_module.resources
    vpc.type == "aws_vpc"

    some subnet1 in input.configuration.root_module.resources
    subnet1.type == "aws_subnet"
    vpc.address in subnet1.expressions.vpc_id.references

    some subnet2 in input.configuration.root_module.resources
    subnet2.type == "aws_subnet"
    vpc.address in subnet2.expressions.vpc_id.references

    not subnet1 == subnet2
    
    some subnet_group in input.configuration.root_module.resources
    subnet_group.type == "aws_redshift_subnet_group"
    subnet1.address in subnet_group.expressions.subnet_ids.references
    subnet2.address in subnet_group.expressions.subnet_ids.references
    
    some cluster in input.configuration.root_module.resources
        cluster.type == "aws_redshift_cluster"
    
    some endpoint in input.configuration.root_module.resources
    endpoint.type == "aws_redshift_endpoint_access"
    cluster.address in endpoint.expressions.cluster_identifier.references
    subnet_group.address in endpoint.expressions.subnet_group_name.references
}