znyang/ambig-iac huggingface dataset:
Task: Create a S3 bucket and an example website configuration resource for the S3 bucket.

Specification:
Has an aws_s3_bucket

Has an aws_s3_bucket_website_configuration
with bucket = bucket id OR name

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_website_configuration" "example" {
  bucket = aws_s3_bucket.example.id
}

Validation policy (checks.rego):
package aws_s3_bucket_website
import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some website in input.configuration.root_module.resources
    website.type == "aws_s3_bucket_website_configuration"

    bucket.address in website.expressions.bucket.references
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some website in input.configuration.root_module.resources
    website.type == "aws_s3_bucket_website_configuration"

    website.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}
Task: Create a S3 bucket and host a static website. The website should use "index.html" in my bucket as the index page.

Specification:
Has an aws_s3_bucket

Has an aws_s3_bucket_website_configuration
with bucket = bucket id OR name
with index_document = { suffix = "index.html" }

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_website_configuration" "example" {
  bucket = aws_s3_bucket.example.id

  index_document {
    suffix = "index.html"
  }
}

Validation policy (checks.rego):
package aws_s3_bucket_website
import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some website in input.configuration.root_module.resources
    website.type == "aws_s3_bucket_website_configuration"
    some index in website.expressions.index_document
    index.suffix.constant_value == "index.html"

    bucket.address in website.expressions.bucket.references
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some website in input.configuration.root_module.resources
    website.type == "aws_s3_bucket_website_configuration"
    some index in website.expressions.index_document
    index.suffix.constant_value == "index.html"

    website.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}
Task: Create a S3 bucket and an example public access block resource for the S3 bucket.

Specification:
Has an aws_s3_bucket

Has an aws_s3_bucket_public_access
with bucket = bucket id OR name

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_public_access_block" "example" {
  bucket = aws_s3_bucket.example.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

Validation policy (checks.rego):
package aws_s3_bucket_public_access_block

import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"

        some public_access in input.configuration.root_module.resources
        public_access.type == "aws_s3_bucket_public_access_block"

        bucket.address in public_access.expressions.bucket.references
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"

        some public_access in input.configuration.root_module.resources
        public_access.type == "aws_s3_bucket_public_access_block"

        public_access.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}
Task: Create a S3 bucket and an example payment configuration resource for the S3 bucket.

Specification:
Has an aws_s3_bucket

Has an aws_s3_bucket_request_payment_configuration
with bucket = bucket id OR name

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_request_payment_configuration" "example" {
  bucket = aws_s3_bucket.example.id
  payer  = "Requester"
}

Validation policy (checks.rego):
package aws_s3_bucket_payment_config
import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"

        some payment_config in input.configuration.root_module.resources
        payment_config.type == "aws_s3_bucket_request_payment_configuration"

        bucket.address in payment_config.expressions.bucket.references
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"

        some payment_config in input.configuration.root_module.resources
        payment_config.type == "aws_s3_bucket_request_payment_configuration"

        payment_config.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}
Task: Create a S3 bucket and an example payment configuration resource for the S3 bucket with the bucket owner paying for fees.

Specification:
Has an aws_s3_bucket

Has an aws_s3_bucket_request_payment_configuration
with bucket = bucket id OR name
with payer = "BucketOwner"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_request_payment_configuration" "example" {
  bucket = aws_s3_bucket.example.id
  payer  = "BucketOwner"
}

Validation policy (checks.rego):
package aws_s3_bucket_payment_config
import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"

        some payment_config in input.configuration.root_module.resources
        payment_config.type == "aws_s3_bucket_request_payment_configuration"
        payment_config.expressions.payer.constant_value == "BucketOwner"

        bucket.address in payment_config.expressions.bucket.references
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"

        some payment_config in input.configuration.root_module.resources
        payment_config.type == "aws_s3_bucket_request_payment_configuration"
        payment_config.expressions.payer.constant_value == "BucketOwner"
        
        payment_config.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}
Task: Create a S3 bucket where the bucket owner pays for fees.

Specification:
Has an aws_s3_bucket

Has an aws_s3_bucket_request_payment_configuration
with bucket = bucket id OR name
with payer = "BucketOwner"

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "mybucket"
}

resource "aws_s3_bucket_request_payment_configuration" "example" {
  bucket = aws_s3_bucket.example.id
  payer  = "BucketOwner"
}

Validation policy (checks.rego):
package aws_s3_bucket_payment_config
import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"

        some payment_config in input.configuration.root_module.resources
        payment_config.type == "aws_s3_bucket_request_payment_configuration"
        payment_config.expressions.payer.constant_value == "BucketOwner"

        bucket.address in payment_config.expressions.bucket.references
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
        some bucket in input.configuration.root_module.resources
        bucket.type == "aws_s3_bucket"

        some payment_config in input.configuration.root_module.resources
        payment_config.type == "aws_s3_bucket_request_payment_configuration"
        payment_config.expressions.payer.constant_value == "BucketOwner"
        
        payment_config.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}
Task: Create a S3 bucket and an example versioning resource for the S3 bucket.

Specification:
Has an aws_s3_bucket

Has an aws_s3_bucket_versioning
with bucket = bucket id OR name

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "example-bucket"
}

resource "aws_s3_bucket_versioning" "versioning_example" {
  bucket = aws_s3_bucket.example.id
  versioning_configuration {
    status = "Enabled"
  }
}

Validation policy (checks.rego):
package aws_s3_bucket_versioning
import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some versioning in input.configuration.root_module.resources
    versioning.type == "aws_s3_bucket_versioning"

    bucket.address in versioning.expressions.bucket.references
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some versioning in input.configuration.root_module.resources
    versioning.type == "aws_s3_bucket_versioning"
    
    versioning.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}
Task: Create a S3 bucket with versioning disabled.

Specification:
Has an aws_s3_bucket

Has an aws_s3_bucket_versioning
with bucket = bucket id OR name
with versioning_configuration = { status = "Disabled" } 

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "example" {
  bucket = "example-bucket"
}

resource "aws_s3_bucket_versioning" "versioning_example" {
  bucket = aws_s3_bucket.example.id
  versioning_configuration {
    status = "Disabled"
  }
}

Validation policy (checks.rego):
package aws_s3_bucket_versioning
import future.keywords.in

default valid := false

valid { # IF THE BUCKET IS REFERRED TO BY ID
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some versioning in input.configuration.root_module.resources
    versioning.type == "aws_s3_bucket_versioning"

    bucket.address in versioning.expressions.bucket.references
}

valid { # IF THE BUCKET IS REFFERED TO BY NAME
    some bucket in input.configuration.root_module.resources
    bucket.type == "aws_s3_bucket"

    some versioning in input.configuration.root_module.resources
    versioning.type == "aws_s3_bucket_versioning"
    
    versioning.expressions.bucket.constant_value == bucket.expressions.bucket.constant_value
}
Task: defines an AWS RDS option group named "option-group-pike" with major engine version 11, and use the sqlserver-ee engine. It should have options for "SQLSERVER_AUDIT" and "TDE"

Specification:
Has one "aws_db_option_group" resource
    with one "engine_name" = "sqlserver-ee"
    with one "major_engine_version" = "11.00"
    with options for "SQLSERVER_AUDIT" and "TDE"

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_db_option_group" "example" {
  name                     = "option-group-pike"
  option_group_description = "Terraform Option Group"
  engine_name              = "sqlserver-ee"
  major_engine_version     = "11.00"

  option {
    db_security_group_memberships  = []
    option_name                    = "SQLSERVER_AUDIT"
    port                           = 0
    vpc_security_group_memberships = []

    option_settings {
      name  = "IAM_ROLE_ARN"
      value = "arn:aws:iam::680235478471:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS"
    }
    option_settings {
      name  = "S3_BUCKET_ARN"
      value = "arn:aws:s3:::testbucketineu-west2/rds"
    }
  }

  option {
    option_name = "TDE"
    port        = 0
  }

  tags = {
    pike = "permissions"
  }
}

Validation policy (checks.rego):
package rds_new 

default is_valid_db_option_group = false

# Regex pattern to match "11", "11.0", "11.00", etc.
pattern := `^11(\.0+)?$`

# Validate aws_db_option_group resource
is_valid_db_option_group {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_db_option_group"
    resource.expressions.engine_name.constant_value == "sqlserver-ee"
    major_engine_version_value := resource.expressions.major_engine_version.constant_value
    is_valid_version(major_engine_version_value)
    resource.expressions.name.constant_value == "option-group-pike"

    # Ensure options for SQLSERVER_AUDIT and TDE are included
    sqlserver_audit_option := resource.expressions.option[_]
    sqlserver_audit_option.option_name.constant_value == "SQLSERVER_AUDIT"
    tde_option := resource.expressions.option[_]
    tde_option.option_name.constant_value == "TDE"
}

# Helper function to check if the version matches the regex pattern
is_valid_version(version) {
    regex.match(pattern, sprintf("%v", [version]))
}
Task: defines an AWS RDS option group named "option-group-pike" with major engine version 11, and use the sqlserver-ee engine. It should have options for "SQLSERVER_AUDIT" and "TDE". IAM_ROLE_ARN and S3_BUCKET_ARN are included under SQLSERVER_AUDIT option

Specification:
Has one "aws_db_option_group" resource
    with one "engine_name" = "sqlserver-ee"
    with one "major_engine_version" = "11.00"
    with options for "SQLSERVER_AUDIT" and "TDE"
    with specific settings for "IAM_ROLE_ARN" and "S3_BUCKET_ARN"

Terraform configuration (main.tf):
provider "aws" {
  region = "us-east-1"
}

resource "aws_db_option_group" "example" {
  name                     = "option-group-pike"
  option_group_description = "Terraform Option Group"
  engine_name              = "sqlserver-ee"
  major_engine_version     = "11.00"

  option {
    db_security_group_memberships  = []
    option_name                    = "SQLSERVER_AUDIT"
    port                           = 0
    vpc_security_group_memberships = []

    option_settings {
      name  = "IAM_ROLE_ARN"
      value = "arn:aws:iam::680235478471:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS"
    }
    option_settings {
      name  = "S3_BUCKET_ARN"
      value = "arn:aws:s3:::testbucketineu-west2/rds"
    }
  }

  option {
    option_name = "TDE"
    port        = 0
  }

  tags = {
    pike = "permissions"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_option_group = false

# Regex pattern to match "11", "11.0", "11.00", etc.
pattern := `^11(\.0+)?$`

# Validate aws_db_option_group resource
is_valid_db_option_group {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_db_option_group"
    resource.expressions.engine_name.constant_value == "sqlserver-ee"
    major_engine_version_value := resource.expressions.major_engine_version.constant_value
    is_valid_version(major_engine_version_value)
    resource.expressions.name.constant_value == "option-group-pike"

    # Ensure options for SQLSERVER_AUDIT and TDE are included
    sqlserver_audit_option := resource.expressions.option[_]
    sqlserver_audit_option.option_name.constant_value == "SQLSERVER_AUDIT"
    tde_option := resource.expressions.option[_]
    tde_option.option_name.constant_value == "TDE"

    # Ensure specific settings for IAM_ROLE_ARN and S3_BUCKET_ARN are included under SQLSERVER_AUDIT option
    iam_role_arn_setting := sqlserver_audit_option.option_settings[_]
    iam_role_arn_setting.name.constant_value == "IAM_ROLE_ARN"
    iam_role_arn_setting.value != null
    s3_bucket_arn_setting := sqlserver_audit_option.option_settings[_]
    s3_bucket_arn_setting.name.constant_value == "S3_BUCKET_ARN"
    s3_bucket_arn_setting.value != null

}

# Helper function to check if the version matches the regex pattern
is_valid_version(version) {
    regex.match(pattern, sprintf("%v", [version]))
}
Task: generate Basic Amazon Lightsail

Specification:
have one "aws_lightsail_instance" resource
    with "name" argument
    with "availability_zone" argument
    with "blueprint_id" argument
    with "bundle_id" argument

Terraform configuration (main.tf):
provider "aws" {
  region     = "us-east-1"
}

resource "aws_lightsail_instance" "custom" {
  name              = "custom"
  availability_zone = "us-east-1a"
  blueprint_id      = "amazon_linux_2"
  bundle_id         = "nano_2_0"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_lightsail_instance = false

is_valid_lightsail_instance {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_lightsail_instance"
    has_required_arguments(resource.values)
}

has_required_arguments(values) {
    values.name
    values.availability_zone
    values.blueprint_id
    values.bundle_id
}
Task: generate Basic Amazon Lightsail with user Data

Specification:
have one "aws_lightsail_instance" resource
    with "name" argument
    with "availability_zone" argument
    with "blueprint_id" argument
    with "bundle_id" argument
    with "user_data" argument

Terraform configuration (main.tf):
provider "aws" {
  region     = "us-east-1"
}

resource "aws_lightsail_instance" "custom" {
  name              = "custom"
  availability_zone = "us-east-1b"
  blueprint_id      = "amazon_linux_2"
  bundle_id         = "nano_1_0"
  user_data         = "sudo yum install -y httpd && sudo systemctl start httpd && sudo systemctl enable httpd && echo '<h1>Deployed via Terraform</h1>' | sudo tee /var/www/html/index.html"
}

Validation policy (checks.rego):
package aws_lightsail_instance

# aws_lightsail_instance attributes - optional

default lightsail_instance_valid := false

lightsail_instance_valid {
	instance := input.configuration.root_module.resources[_]
	instance.type == "aws_lightsail_instance"
    expressions := instance.expressions

    # Validate the presence of required arguments
    expressions.name
    expressions.availability_zone
    expressions.blueprint_id
    expressions.bundle_id
    expressions.user_data
}

# You can add more specific validations here if needed.
# For example, if you want to check if the name follows a specific format,
# you could write a rule like this:

name_is_valid {
	instance := input.configuration.root_module.resources[_]
	instance.type == "aws_lightsail_instance"
	regex.match("^[a-zA-Z0-9-_]+$", instance.expressions.name.constant_value)
}
Task: generate aws lightsail with auto snapshots enabled

Specification:
have one "aws_lightsail_instance" resource
with "name" argument
with "availability_zone" argument
with "blueprint_id" argument
with "bundle_id" argument
with "add_on" argument
    with type = "AutoSnapshot"
    with snapshot_time argument
    with status = "Enabled"

Terraform configuration (main.tf):
provider "aws" {
  region     = "us-east-1"
}

resource "aws_lightsail_instance" "test" {
  name              = "custom_instance"
  availability_zone = "us-east-1b"
  blueprint_id      = "amazon_linux_2"
  bundle_id         = "nano_2_0"
  add_on {
    type          = "AutoSnapshot"
    snapshot_time = "06:00"
    status        = "Enabled"
  }
  tags = {
    foo = "bar"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_lightsail_instance = false

is_valid_lightsail_instance {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_lightsail_instance"
    has_required_arguments(resource.values)
    has_valid_add_on(resource.values.add_on)
}

has_required_arguments(values) {
    values.name
    values.availability_zone
    values.blueprint_id
    values.bundle_id
}

has_valid_add_on(add_ons) {
    add_on := add_ons[_]
    add_on.type == "AutoSnapshot"
    add_on.snapshot_time
    add_on.status == "Enabled"
}
Task: create AWS Lightsail with default blueprint

Specification:
have one "aws_lightsail_instance" resource
with "name" argument
with "availability_zone" argument
with "blueprint_id" argument
with "bundle_id" argument

Terraform configuration (main.tf):
provider "aws" {
  region     = "us-east-1"
}

resource "aws_lightsail_instance" "gitlab_test" {
  name              = "custom_gitlab"
  availability_zone = "us-east-1b"
  blueprint_id      = "amazon_linux_2"
  bundle_id         = "nano_2_0"
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_lightsail_instance = false

is_valid_lightsail_instance {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_lightsail_instance"
    has_required_arguments(resource.values)
}

has_required_arguments(values) {
    values.name
    values.availability_zone
    values.blueprint_id
    values.bundle_id
}
Task: create AWS Lightsail with WordPress blueprint

Specification:
have one "aws_lightsail_instance" resource
with "name" argument
with "availability_zone" argument
with "blueprint_id" = wordpress
with "bundle_id" argument

Terraform configuration (main.tf):
provider "aws" {
  region     = "us-east-1"
}

resource "aws_lightsail_instance" "custom" {
  name              = "custom"
  availability_zone = "us-east-1b"
  blueprint_id      = "wordpress"
  bundle_id         = "nano_2_0"
 }

Validation policy (checks.rego):
package terraform.validation

default has_valid_lightsail_instance = false

# Main rule to check for a valid aws_lightsail_instance
has_valid_lightsail_instance {
    resource := input.planned_values.root_module.resources[_]
    resource.type == "aws_lightsail_instance"
    resource.values.name
    resource.values.availability_zone
    resource.values.blueprint_id == "wordpress"
    resource.values.bundle_id
}