znyang/ambig-iac huggingface dataset:
Task: managing an AWS Lightsail Distribution with a instance as an origin

Specification:
have one aws_lightsail_instance
    with "name" argument
    with "availability_zone" argument
    with "blueprint_id" argument
    with "bundle_id" argument

have one aws_lightsail_distribution
    with name
    with bundle_id
    with default_cache_behavior 
        with behavior
    with origin 
        with name
        with region_name
    with cache_behavior_settings 
        with forwarded_cookies
            with cookies_allow_list 
        with forwarded_headers  
            with headers_allow_list 
        with forwarded_query_strings 
            with query_strings_allowed_list


Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

data "aws_availability_zones" "available" {
  state = "available"

  filter {
    name   = "opt-in-status"
    values = ["opt-in-not-required"]
  }
}

resource "aws_lightsail_static_ip_attachment" "test" {
  static_ip_name = aws_lightsail_static_ip.test.name
  instance_name  = aws_lightsail_instance.test.name
}

resource "aws_lightsail_static_ip" "test" {
  name = "test-static-ip"
}

resource "aws_lightsail_instance" "test" {
  name              = "test-instance"
  availability_zone = data.aws_availability_zones.available.names[0]
  blueprint_id      = "amazon_linux_2"
  bundle_id         = "micro_1_0"
}

resource "aws_lightsail_distribution" "test" {
  name       = "test-distribution"
  depends_on = [aws_lightsail_static_ip_attachment.test]
  bundle_id  = "small_1_0"
  origin {
    name        = aws_lightsail_instance.test.name
    region_name = data.aws_availability_zones.available.id
  }
  default_cache_behavior {
    behavior = "cache"
  }
}

Validation policy (checks.rego):
package terraform.validation

default has_valid_lightsail_resources = false

# Rule for aws_lightsail_instance resource
has_lightsail_instance {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lightsail_instance"
}

# Rule for aws_lightsail_distribution resource
has_lightsail_distribution {
    some i
    resource := input.planned_values.root_module.resources[i]
    resource.type == "aws_lightsail_distribution"
}

# Combined rule to ensure both resources are present
has_valid_lightsail_resources {
    has_lightsail_instance
    has_lightsail_distribution
}
Task: an S3 Glacier vault for long-term data archiving

Specification:
has one "aws_glacier_vault" resource
     with "name" attribute

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"  # Replace with your desired AWS region
}

resource "aws_glacier_vault" "example" {
  name = "my-glacier-vault"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_glacier_vault = false

# Rule to validate if there is at least one aws_glacier_vault resource with a name attribute
is_valid_glacier_vault {
    # Find a resource that is of type aws_glacier_vault
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_glacier_vault"

    # Check that the resource has a name attribute
    has_value(resource.values.name)
}

# Helper function to check if a value exists (not null)
has_value(value) {
    not is_null(value)
}
Task: generate a aws storage for long term data and backup

Specification:
has one "aws_glacier_vault" resource
     with "name" attribute

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"  # Replace with your desired AWS region
}

resource "aws_glacier_vault" "example" {
  name = "my-glacier-vault"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_glacier_vault = false

# Rule to validate if there is at least one aws_glacier_vault resource with a name attribute
is_valid_glacier_vault {
    # Find a resource that is of type aws_glacier_vault
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_glacier_vault"

    # Check that the resource has a name attribute
    has_value(resource.values.name)
}

# Helper function to check if a value exists (not null)
has_value(value) {
    not is_null(value)
}
Task: generate an S3 Glacier vault and use it with AWS Data Lifecycle Manager

Specification:
has one "aws_glacier_vault" resource
     with "name" attribute

has one "aws_dlm_lifecycle_policy" resource
    with "description" attribute
    with "execution_role_arn"
    with "policy_details"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_glacier_vault" "example" {
  name = "my-glacier-vault"
}

resource "aws_dlm_lifecycle_policy" "example" {
  description = "Automated archiving policy"

  execution_role_arn = "arn:aws:iam::123456789012:role/DLMServiceRole"  # Replace with your DLM execution role ARN

  policy_details {
    resource_types = ["VOLUME"]
    target_tags = {
      "archive" = "true"
    }
    schedule {
      name = "2 weeks of daily snapshots"

      create_rule {
        interval      = 24
        interval_unit = "HOURS"
        times         = ["23:45"]
      }

      retain_rule {
        count = 14
      }

      tags_to_add = {
        SnapshotCreator = "DLM"
      }

      copy_tags = false
    }
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_terraform_plan = false

# Rule to check for an AWS Glacier Vault resource with a 'name' attribute
is_valid_glacier_vault {
        resource := input.planned_values.root_module.resources[_]
        resource.type == "aws_glacier_vault"
        not is_null(resource.values.name)
}

# Rule to check for an AWS DLM Lifecycle Policy with required attributes
is_valid_dlm_lifecycle_policy {
        resource := input.planned_values.root_module.resources[_]
        resource.type == "aws_dlm_lifecycle_policy"
        not is_null(resource.values.description)
#         not is_null(resource.values.execution_role_arn)
        not is_null(resource.values.policy_details)
    
    execution_role_arn_configured(resource)
}

execution_role_arn_configured(_) {
    role_resource := input.configuration.root_module.resources[_]
    role_resource.type == "aws_dlm_lifecycle_policy"
#     role_resource.name == "dlm_lifecycle_role"
    not is_null(role_resource.expressions.execution_role_arn)
}

# Combined rule to validate the entire Terraform plan
is_valid_terraform_plan {
        is_valid_glacier_vault
        is_valid_dlm_lifecycle_policy
}
Task: generate an S3 Glacier vault with notification service

Specification:
has one "aws_glacier_vault" resource
     with "name" attribute
     with "notification" attribute
          with "event" attribute
          with "sns_topic" attribute

with "aws_sns_topic" resource

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_sns_topic" "aws_sns_topic" {
  name = "glacier-sns-topic"
}

data "aws_iam_policy_document" "my_archive" {
  statement {
    sid    = "add-read-only-perm"
    effect = "Allow"

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    actions = [
      "glacier:InitiateJob",
      "glacier:GetJobOutput",
    ]

    resources = ["arn:aws:glacier:eu-west-1:432981146916:vaults/MyArchive"]
  }
}

resource "aws_glacier_vault" "my_archive" {
  name = "MyArchive"

  notification {
    sns_topic = aws_sns_topic.aws_sns_topic.arn
    events    = ["ArchiveRetrievalCompleted", "InventoryRetrievalCompleted"]
  }

  access_policy = data.aws_iam_policy_document.my_archive.json

  tags = {
    Test = "MyArchive"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_terraform_plan = false

# Rule to check for an AWS Glacier Vault resource with 'name' and 'notification' attributes
is_valid_glacier_vault {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_glacier_vault"
	not is_null(resource.name)
	not is_null(resource.expressions)
	not is_null(resource.expressions.notification[0].sns_topic)
	not is_null(resource.expressions.notification[0].events)
}


# Rule to check for the existence of an AWS SNS Topic resource
is_valid_sns_topic {
	sns_topic_resource := input.planned_values.root_module.resources[_]
	sns_topic_resource.type == "aws_sns_topic"
}

# Combined rule to validate the entire Terraform plan
is_valid_terraform_plan {
	is_valid_glacier_vault
	is_valid_sns_topic
}
Task: generate an S3 Glacier vault with notification service integrated with aws sns

Specification:
has one "aws_glacier_vault" resource
     with "name" attribute
     with "notification" attribute
          with "event" attribute
          with "sns_topic" attribute

with "aws_sns_topic" resource

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_sns_topic" "aws_sns_topic" {
  name = "glacier-sns-topic"
}

data "aws_iam_policy_document" "my_archive" {
  statement {
    sid    = "add-read-only-perm"
    effect = "Allow"

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    actions = [
      "glacier:InitiateJob",
      "glacier:GetJobOutput",
    ]

    resources = ["arn:aws:glacier:eu-west-1:432981146916:vaults/MyArchive"]
  }
}

resource "aws_glacier_vault" "my_archive" {
  name = "MyArchive"

  notification {
    sns_topic = aws_sns_topic.aws_sns_topic.arn
    events    = ["ArchiveRetrievalCompleted", "InventoryRetrievalCompleted"]
  }

  access_policy = data.aws_iam_policy_document.my_archive.json

  tags = {
    Test = "MyArchive"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_terraform_plan = false

# Rule to check for an AWS Glacier Vault resource with 'name' and 'notification' attributes
is_valid_glacier_vault {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_glacier_vault"
	not is_null(resource.name)
	not is_null(resource.expressions)
	not is_null(resource.expressions.notification[0].sns_topic)
	not is_null(resource.expressions.notification[0].events)
}


# Rule to check for the existence of an AWS SNS Topic resource
is_valid_sns_topic {
	sns_topic_resource := input.planned_values.root_module.resources[_]
	sns_topic_resource.type == "aws_sns_topic"
}

# Combined rule to validate the entire Terraform plan
is_valid_terraform_plan {
	is_valid_glacier_vault
	is_valid_sns_topic
}
Task: generage an S3 Glacier vault with a access policy

Specification:
has one "aws_glacier_vault" resource
     with "name" attribute
     with "access_policy" attribute

Terraform configuration (main.tf):
provider "aws" {
  region     = "us-east-1"
}

data "aws_iam_policy_document" "my_archive" {
  statement {
    sid    = "add-read-only-perm"
    effect = "Allow"

    principals {
      type        = "*"
      identifiers = ["*"]
    }

    actions = [
      "glacier:InitiateJob",
      "glacier:GetJobOutput",
    ]

    resources = ["arn:aws:glacier:eu-west-1:432981146916:vaults/MyArchive"]
  }
}

resource "aws_glacier_vault" "my_archive" {
  name = "MyArchive"
  access_policy = data.aws_iam_policy_document.my_archive.json

  tags = {
    Test = "MyArchive"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_terraform_plan = false

# Rule to check for an AWS Glacier Vault resource with 'name' and 'access_policy' attributes
is_valid_glacier_vault {
	resource := input.planned_values.root_module.resources[_]
	resource.type == "aws_glacier_vault"
	not is_null(resource.values.name)
	not is_null(resource.values.access_policy)
}

# Combined rule to validate the entire Terraform plan
is_valid_terraform_plan {
	is_valid_glacier_vault
}
Task: generage an S3 Glacier vault with a Vault Lock

Specification:
has one "aws_glacier_vault" resource
     with "name" attribute

implicit:
has one "aws_iam_policy_document" data
has one "aws_glacier_vault_lock" resource

Terraform configuration (main.tf):
provider "aws" {
  region     = "us-east-1"
}

resource "aws_glacier_vault" "example" {
  name = "example"
}

data "aws_iam_policy_document" "example" {
  statement {
    actions   = ["glacier:DeleteArchive"]
    effect    = "Deny"
    resources = [aws_glacier_vault.example.arn]

    condition {
      test     = "NumericLessThanEquals"
      variable = "glacier:ArchiveAgeinDays"
      values   = ["365"]
    }
  }
}

resource "aws_glacier_vault_lock" "example" {
  complete_lock = false
  policy        = data.aws_iam_policy_document.example.json
  vault_name    = aws_glacier_vault.example.name
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_terraform_plan = false

# Rule to check for an AWS Glacier Vault resource with 'name' and 'access_policy' attributes
is_valid_glacier_vault {
	resource := input.planned_values.root_module.resources[_]
	resource.type == "aws_glacier_vault"
	not is_null(resource.values.name)
}

# Rule to check for the existence of an AWS Glacier Vault Lock resource
is_valid_glacier_vault_lock {
	resource := input.planned_values.root_module.resources[_]
	resource.type == "aws_glacier_vault_lock"
}

# Combined rule to validate the entire Terraform plan
is_valid_terraform_plan {
	is_valid_glacier_vault
	is_valid_glacier_vault_lock
}
Task: generage an S3 Glacier vault with a access policy using "aws_iam_policy_document" data and lock the policy using "aws_glacier_vault_lock"

Specification:
has one "aws_glacier_vault" resource
     with "name" attribute
     with "access_policy" attributr

implicit:
has one "aws_iam_policy_document" data
has one "aws_glacier_vault_lock" resource

Terraform configuration (main.tf):
provider "aws" {
  region     = "us-east-1"
}

resource "aws_glacier_vault" "example" {
  name = "example"
}

data "aws_iam_policy_document" "example" {
  statement {
    actions   = ["glacier:DeleteArchive"]
    effect    = "Deny"
    resources = [aws_glacier_vault.example.arn]

    condition {
      test     = "NumericLessThanEquals"
      variable = "glacier:ArchiveAgeinDays"
      values   = ["365"]
    }
  }
}

resource "aws_glacier_vault_lock" "example" {
  complete_lock = false
  policy        = data.aws_iam_policy_document.example.json
  vault_name    = aws_glacier_vault.example.name
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_terraform_plan = false

# Rule to check for an AWS Glacier Vault resource with 'name' and 'access_policy' attributes
is_valid_glacier_vault {
	resource := input.planned_values.root_module.resources[_]
	resource.type == "aws_glacier_vault"
	not is_null(resource.values.name)
}

# Rule to check for the existence of an AWS Glacier Vault Lock resource
is_valid_glacier_vault_lock {
	resource := input.planned_values.root_module.resources[_]
	resource.type == "aws_glacier_vault_lock"
}

# Combined rule to validate the entire Terraform plan
is_valid_terraform_plan {
	is_valid_glacier_vault
	is_valid_glacier_vault_lock
}
Task: generage an S3 Glacier vault that pushes notification when archive retrieval completed

Specification:
has one "aws_glacier_vault" resource
     with "name" attribute
     with notification attribute
        with sns_topic attribute
        with events attribute

has one aws_sns_topic resources
    with name attribute

Terraform configuration (main.tf):
provider "aws" {
  region     = "us-east-1"
}

# Create an SNS topic for notifications
resource "aws_sns_topic" "glacier_notifications" {
  name = "glacier-archive-retrieval-notifications"
}

# Create an S3 Glacier Vault
resource "aws_glacier_vault" "my_archive" {
  name = "MyArchive"

  notification {
    sns_topic = aws_sns_topic.glacier_notifications.arn
    events    = ["ArchiveRetrievalCompleted"]
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_terraform_plan = false

# Rule to check for an AWS Glacier Vault resource with 'name' and 'notification' attributes
is_valid_glacier_vault {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_glacier_vault"
    not is_null(resource.values.name)
    not is_null(resource.values.notification)
}

# Rule to check for the existence of an AWS SNS Topic resource with 'name' attribute
is_valid_sns_topic {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_sns_topic"
    not is_null(resource.values.name)
}

# Combined rule to validate the entire Terraform plan
is_valid_terraform_plan {
    is_valid_glacier_vault
    is_valid_sns_topic
}
Task: create a basic AWS RDS instance

Specification:
Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"

Terraform configuration (main.tf):
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_db_instance" "default" {
  allocated_storage    = 10
  db_name              = "mydb"
  engine               = "mysql"
  engine_version       = "5.7"
  instance_class       = "db.t3.micro"
  username             = "foo"
  password             = "foobarbaz"
  parameter_group_name = "default.mysql5.7"
  skip_final_snapshot  = true
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
	resource := input.configuration.root_module.resources[_]
	resource.type == "aws_db_instance"
	requirement1(resource.expressions)
	requirement2(resource.expressions)
    requirement3(resource.expressions)
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
	expressions.allocated_storage
	expressions.engine
    expressions.username
	is_valid_engine(expressions.engine.constant_value)
}

requirement1(expressions) {
	expressions.snapshot_identifier
}

requirement1(expressions) {
	expressions.replicate_source_db
}

requirement2(expressions) {
	expressions.instance_class
	is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
	expressions.password
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

requirement3(expressions) {
	expressions.snapshot_identifier
}

requirement3(expressions) {
	expressions.replicate_source_db
}

requirement3(expressions) {
	expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
	engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
	engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
	instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
	startswith(instance_class, prefix)
}
Task: create a basic AWS SQL database

Specification:
Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" and a valid engine value
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_db_instance" "default" {
  allocated_storage    = 10
  engine               = "mysql"
  instance_class       = "db.t3.micro"
  username             = "foo"
  password             = "foobarbaz"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false

# Rule to check if a valid aws_db_instance exists
is_valid_db_instance {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_db_instance"
        has_required_db_arguments
}

# Helper rule to check if all required arguments are present and valid
has_required_db_arguments {
        resource := input.configuration.root_module.resources[_]
        resource.type == "aws_db_instance"
        requirement1(resource.expressions)
        requirement2(resource.expressions)
    requirement3(resource.expressions)
}

# 1, allocated_storage and engine or snapshot_identifier or replace_source_db
requirement1(expressions) {
        expressions.allocated_storage
        expressions.engine.constant_value == "mysql"
    expressions.username
        is_valid_engine(expressions.engine.constant_value)
}

requirement2(expressions) {
        expressions.instance_class
        is_valid_instance_class(expressions.instance_class.constant_value)
}

requirement3(expressions) {
        expressions.password
}

requirement3(expressions) {
        expressions.manage_master_user_password
}

requirement3(expressions) {
        expressions.snapshot_identifier
}

requirement3(expressions) {
        expressions.replicate_source_db
}

requirement3(expressions) {
        expressions.manage_master_user_password
}

# Helper rule to validate engine value
is_valid_engine(engine) {
        engine_set := {
        "mysql",
        "postgres",
        "mariadb",
        "oracle-se",
        "oracle-se1",
        "oracle-se2",
        "oracle-ee",
        "sqlserver-ee",
        "sqlserver-se",
        "sqlserver-ex",
        "sqlserver-web"
    }
        engine_set[engine]
}

# Helper rule to validate instance class type
is_valid_instance_class(instance_class) {
        instance_class_starts_with(instance_class, "db.")
}

# Helper rule to check prefix of instance class
instance_class_starts_with(instance_class, prefix) {
        startswith(instance_class, prefix)
}