How do I write rules for "dynamic" blocks?

[CallumHibbert]

Sometimes I might declare a DynamoDB global table like this:

resource aws_dynamodb_table table {
  billing_mode = "PAY_PER_REQUEST"
  name         = "dynamodb_table_name"
  dynamic replica {
    for_each = var.table_replication_regions
    content {
      propagate_tags = true
      region_name    = replica.value
    }
  }
}

This allows me to vary the regions the table is replicated to (by passing in the regions via the table_replication_regions list variable).

I would like to write a TFSec rule that ensures propagate_tags is true for this sort of scenario. How can I do that? I can't find a way to do a subMatch on a dynamic block.

[andrew-aiken]

+1