znyang/ambig-iac huggingface dataset:
Task: configures AWS as the cloud provider. It defines an AWS VPC with a specific CIDR block of 10.0.0.0/16 and a network ACL linked to this VPC that allows specific TCP traffic for both ingress (10.3.0.0/18 on port 80) and egress (10.3.0.0/18 on port 443) rules.

Specification:
Has one "aws_vpc" resource:
with a specified "cidr_block" of "10.0.0.0/16"

Has one "aws_network_acl" resource:
linked to the "aws_vpc" resource
with ingress rules allowing TCP traffic from "10.3.0.0/18" on port 80
with egress rules allowing TCP traffic to "10.3.0.0/18" on port 443

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_network_acl" "example" {
  vpc_id = aws_vpc.example.id

  egress {
    protocol   = "tcp"
    rule_no    = 200
    action     = "allow"
    cidr_block = "10.3.0.0/18"
    from_port  = 443
    to_port    = 443
  }

  ingress {
    protocol   = "tcp"
    rule_no    = 100
    action     = "allow"
    cidr_block = "10.3.0.0/18"
    from_port  = 80
    to_port    = 80
  }
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation states
default is_valid_network_acl = false

# Validate aws_network_acl resources
is_valid_network_acl {
        some i
        network_acl := input.configuration.root_module.resources[i]
        network_acl.type == "aws_network_acl"
        network_acl.name == "example" # Assuming the resource name is "example"

        # Validate linked VPC
        network_acl.expressions.vpc_id.references[0] == "aws_vpc.example.id"
        
        # Check ingress rules for allowing TCP traffic on port 80 from CIDR "10.3.0.0/18"
        ingress := network_acl.expressions.ingress
        ingress.constant_value[0].protocol == "tcp"
        ingress.constant_value[0].rule_no == 100
        ingress.constant_value[0].action == "allow"
        ingress.constant_value[0].cidr_block == "10.3.0.0/18"
        ingress.constant_value[0].from_port == 80
        ingress.constant_value[0].to_port == 80

        # Check egress rules for allowing TCP traffic on port 443 to CIDR "10.3.0.0/18"
        egress := network_acl.expressions.egress
        egress.constant_value[0].protocol == "tcp"
        egress.constant_value[0].rule_no == 200
        egress.constant_value[0].action == "allow"
        egress.constant_value[0].cidr_block == "10.3.0.0/18"
        egress.constant_value[0].from_port == 443
        egress.constant_value[0].to_port == 443
}
Task: configures AWS as the cloud provider. It defines an AWS VPC with a specific CIDR block of 10.0.0.0/16 and a network ACL linked to this VPC that allows specific TCP traffic for both ingress and egress rules.

Specification:
Has one "aws_vpc" resource:
with a specified "cidr_block" of "10.0.0.0/16"

Has one "aws_network_acl" resource:
linked to the "aws_vpc" resource
with ingress rules allowing TCP traffic
with egress rules allowing TCP traffic

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 4.16"
    }
  }

  required_version = ">= 1.2.0"
}
# Define the provider block for AWS
provider "aws" {
  region = "us-east-2" # Set your desired AWS region
}

resource "aws_vpc" "example" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_network_acl" "example" {
  vpc_id = aws_vpc.example.id

  egress {
    protocol   = "tcp"
    rule_no    = 200
    action     = "allow"
    cidr_block = "10.3.0.0/18"
    from_port  = 443
    to_port    = 443
  }

  ingress {
    protocol   = "tcp"
    rule_no    = 100
    action     = "allow"
    cidr_block = "10.3.0.0/18"
    from_port  = 80
    to_port    = 80
  }
}

Validation policy (checks.rego):
package terraform.validation

# Set default validation states
default is_valid_network_acl = false

# Validate aws_network_acl resources
is_valid_network_acl {
        some i
        network_acl := input.configuration.root_module.resources[i]
        network_acl.type == "aws_network_acl"
        network_acl.name == "example" # Assuming the resource name is "example"

        # Validate linked VPC
        network_acl.expressions.vpc_id.references[0] == "aws_vpc.example.id"
        
        # Check ingress rules for allowing TCP traffic on port 80 from CIDR "10.3.0.0/18"
        ingress := network_acl.expressions.ingress
        ingress.constant_value[0].protocol == "tcp"
        ingress.constant_value[0].rule_no == 100
        ingress.constant_value[0].action == "allow"
       

        # Check egress rules for allowing TCP traffic on port 443 to CIDR "10.3.0.0/18"
        egress := network_acl.expressions.egress
        egress.constant_value[0].protocol == "tcp"
        egress.constant_value[0].rule_no == 200
        egress.constant_value[0].action == "allow"
}