Task: creates a MySQL database instance on AWS RDS with a public access security group and a randomly generated password.

Specification:
Has one "aws_db_instance" resource
    with one "allocated_storage"
    with one "engine" = "mysql"
    with one "instance_class" and a valid instance class type
    with one "password"
    with one "username"

has one security_group

has one random_string

Terraform configuration (main.tf):
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.75"
    }
  }

  required_version = ">= 1.9.0"
}

provider "aws" {
  region = "us-east-1"
}

data "aws_region" "current" {}

resource "random_string" "db_password" {
  keepers = {
    region = data.aws_region.current.name
  }

  special = false
  length  = 20
}

resource "aws_db_instance" "main" {
  identifier_prefix      = "go-cloud-test"
  engine                 = "mysql"
  engine_version         = "5.7"
  instance_class         = "db.t3.micro"
  allocated_storage      = 20
  username               = "root"
  password               = random_string.db_password.result
  db_name                = "testdb"
  publicly_accessible    = true
  vpc_security_group_ids = [aws_security_group.main.id]
  skip_final_snapshot    = true
}

resource "aws_security_group" "main" {
  name_prefix = "testdb"
  description = "Security group for the Go CDK MySQL test database."

  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
    description = "Public MySQL access"
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    description = "All outgoing traffic allowed"
  }
}

Validation policy (checks.rego):
package terraform.validation

default is_valid_db_instance = false
default is_valid_security_group = false
default is_valid_random_string = false

# Validate aws_db_instance resource
is_valid_db_instance {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_db_instance"
    resource.expressions.allocated_storage.constant_value != null
    resource.expressions.engine.constant_value == "mysql"
    # Ensure the instance class is valid; specific validation can be added based on requirements
    resource.expressions.instance_class.constant_value != null
    # Ensure the password is set; in real scenarios, ensure it's not hardcoded or ensure it's using a secure reference
    resource.expressions.password.references[0] != null
    resource.expressions.username.constant_value != null
    resource.expressions.publicly_accessible.constant_value == true
}

# Validate aws_security_group resource
is_valid_security_group {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "aws_security_group"
    # Additional checks for specific ingress/egress rules can be added here
}

# Validate random_string resource for the database password
is_valid_random_string {
    some i
    resource := input.configuration.root_module.resources[i]
    resource.type == "random_string"
    # Ensure the random_string is used for the db_instance password
    resource.name == "db_password"
}