Policy for resource with both expand modes

[KazMiddelhoek]

I want to write a policy that raises issues for terraform resources with tags defined, but without a lifecycle defined for some tags.

So this is correct:

resource ... ... 
  tags = {
    tag1 = "abc"
  }

  lifecycle {
    ignore_changes = [
      tags["tag2"],
  ]
}

And this is not:

resource ... ... 
  tags = {
    tag1 = "abc"
  }
}

I believe to test this, I need something like
resources := terraform.resources("*", {"tags": "map(string)", "lifecycle": {"ignore_changes": "expr"} }, { "expand_mode": "expand" })
To return the tags, I need expand_mode = expand (otherwise tags are not returned) , but to return the lifecycle correctly I need expand_mode = none (otherwise I get the error 'Invalid reference; A reference to a resource type must be followed by at least one attribute access, specifying the resource name'.)

How can I solve this problem? Thanks in advance!

[wata727]

Unfortunately, you cannot use different modes at the same time, so you have to get the resources for each and match them by name.
Please let me know if this doesn't work as a workaround.

By the way, tags should be returned even when expand_mode = none, so you might be able to get them all at once by setting expand_mode = none.