Sometimes I might declare a DynamoDB global table like this:

resource aws_dynamodb_table table {
 billing_mode = "PAY_PER_REQUEST"
 name = "dynamodb_table_name"
 dynamic replica {
 for_each = var.table_replication_regions
 content {
 propagate_tags = true
 region_name = replica.value
 }
 }
}

This allows me to vary the regions the table is replicated to (by passing in the regions via the table_replication_regions list variable).

I would like to write a TFSec rule that ensures propagate_tags is true for this sort of scenario. How can I do that? I can't find a way to do a subMatch on a dynamic block.