diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index babbe03d4b..8ab8c1c216 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -1,4 +1,5 @@
 ACCOUNTADMIN
+applyable
 atlassian
 auditlog
 Auths
diff --git a/providers/terraform/connection/hcl_parser_test.go b/providers/terraform/connection/hcl_parser_test.go
index 37e67c1b4f..5160f3d7a3 100644
--- a/providers/terraform/connection/hcl_parser_test.go
+++ b/providers/terraform/connection/hcl_parser_test.go
@@ -30,7 +30,7 @@ func TestLoadHclBlocks(t *testing.T) {
 	require.NotNil(t, parser)
 	tfVars := tf.TfVars()
 	assert.Equal(t, 2, len(tfVars))
-	assert.Equal(t, 5, len(parser.Files()))
+	assert.Equal(t, 6, len(parser.Files()))
 }
 
 func TestLoadTfvars(t *testing.T) {
diff --git a/providers/terraform/connection/testdata/dynamic_block/.terraform.lock.hcl b/providers/terraform/connection/testdata/dynamic_block/.terraform.lock.hcl
new file mode 100644
index 0000000000..e9a7627b51
--- /dev/null
+++ b/providers/terraform/connection/testdata/dynamic_block/.terraform.lock.hcl
@@ -0,0 +1,21 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/helm" {
+  version = "2.17.0"
+  hashes = [
+    "h1:kQMkcPVvHOguOqnxoEU2sm1ND9vCHiT8TvZ2x6v/Rsw=",
+    "zh:06fb4e9932f0afc1904d2279e6e99353c2ddac0d765305ce90519af410706bd4",
+    "zh:104eccfc781fc868da3c7fec4385ad14ed183eb985c96331a1a937ac79c2d1a7",
+    "zh:129345c82359837bb3f0070ce4891ec232697052f7d5ccf61d43d818912cf5f3",
+    "zh:3956187ec239f4045975b35e8c30741f701aa494c386aaa04ebabffe7749f81c",
+    "zh:66a9686d92a6b3ec43de3ca3fde60ef3d89fb76259ed3313ca4eb9bb8c13b7dd",
+    "zh:88644260090aa621e7e8083585c468c8dd5e09a3c01a432fb05da5c4623af940",
+    "zh:a248f650d174a883b32c5b94f9e725f4057e623b00f171936dcdcc840fad0b3e",
+    "zh:aa498c1f1ab93be5c8fbf6d48af51dc6ef0f10b2ea88d67bcb9f02d1d80d3930",
+    "zh:bf01e0f2ec2468c53596e027d376532a2d30feb72b0b5b810334d043109ae32f",
+    "zh:c46fa84cc8388e5ca87eb575a534ebcf68819c5a5724142998b487cb11246654",
+    "zh:d0c0f15ffc115c0965cbfe5c81f18c2e114113e7a1e6829f6bfd879ce5744fbb",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+  ]
+}
diff --git a/providers/terraform/connection/testdata/dynamic_block/main.tf b/providers/terraform/connection/testdata/dynamic_block/main.tf
new file mode 100644
index 0000000000..c8b69dd016
--- /dev/null
+++ b/providers/terraform/connection/testdata/dynamic_block/main.tf
@@ -0,0 +1,37 @@
+variable "environment" {
+  type = string
+}
+
+locals {
+  set = {
+    set1 = {
+      name  = "service.type"
+      value = "LoadBalancer"
+    }
+    set2 = {
+      name  = "replicaCount"
+      value = "2"
+    }
+    set3 = {
+      name  = "ingress.enabled"
+      value = "true"
+    }
+    set4 = {
+      name  = "environment"
+      value = var.environment
+    }
+  }
+}
+resource "helm_release" "nginx" {
+  name       = "my-nginx"
+  chart      = "nginx"
+  repository = "https://charts.bitnami.com/bitnami"
+  version    = "13.2.12"
+  dynamic "set" {
+    for_each = local.set
+    content {
+      name  = set.value.name
+      value = set.value.value
+    }
+  }
+}
diff --git a/providers/terraform/connection/testdata/dynamic_block/tfplan.json b/providers/terraform/connection/testdata/dynamic_block/tfplan.json
new file mode 100644
index 0000000000..b704f8e9e6
--- /dev/null
+++ b/providers/terraform/connection/testdata/dynamic_block/tfplan.json
@@ -0,0 +1 @@
+{"format_version":"1.2","terraform_version":"1.8.5","variables":{"environment":{"value":"dev"}},"planned_values":{"root_module":{"resources":[{"address":"helm_release.nginx","mode":"managed","type":"helm_release","name":"nginx","provider_name":"registry.terraform.io/hashicorp/helm","schema_version":1,"values":{"atomic":false,"chart":"nginx","cleanup_on_fail":false,"create_namespace":false,"dependency_update":false,"description":null,"devel":null,"disable_crd_hooks":false,"disable_openapi_validation":false,"disable_webhooks":false,"force_update":false,"keyring":null,"lint":false,"max_history":0,"name":"my-nginx","namespace":"default","pass_credentials":false,"postrender":[],"recreate_pods":false,"render_subchart_notes":true,"replace":false,"repository":"https://charts.bitnami.com/bitnami","repository_ca_file":null,"repository_cert_file":null,"repository_key_file":null,"repository_password":null,"repository_username":null,"reset_values":false,"reuse_values":false,"set":[{"name":"environment","type":"","value":"dev"},{"name":"ingress.enabled","type":"","value":"true"},{"name":"replicaCount","type":"","value":"2"},{"name":"service.type","type":"","value":"LoadBalancer"}],"set_list":[],"set_sensitive":[],"skip_crds":false,"status":"deployed","timeout":300,"upgrade_install":null,"values":null,"verify":false,"version":"13.2.12","wait":true,"wait_for_jobs":false},"sensitive_values":{"metadata":[],"postrender":[],"repository_password":true,"set":[{},{},{},{}],"set_list":[],"set_sensitive":[]}}]}},"resource_changes":[{"address":"helm_release.nginx","mode":"managed","type":"helm_release","name":"nginx","provider_name":"registry.terraform.io/hashicorp/helm","change":{"actions":["create"],"before":null,"after":{"atomic":false,"chart":"nginx","cleanup_on_fail":false,"create_namespace":false,"dependency_update":false,"description":null,"devel":null,"disable_crd_hooks":false,"disable_openapi_validation":false,"disable_webhooks":false,"force_update":false,"keyring":null,"lint":false,"max_history":0,"name":"my-nginx","namespace":"default","pass_credentials":false,"postrender":[],"recreate_pods":false,"render_subchart_notes":true,"replace":false,"repository":"https://charts.bitnami.com/bitnami","repository_ca_file":null,"repository_cert_file":null,"repository_key_file":null,"repository_password":null,"repository_username":null,"reset_values":false,"reuse_values":false,"set":[{"name":"environment","type":"","value":"dev"},{"name":"ingress.enabled","type":"","value":"true"},{"name":"replicaCount","type":"","value":"2"},{"name":"service.type","type":"","value":"LoadBalancer"}],"set_list":[],"set_sensitive":[],"skip_crds":false,"status":"deployed","timeout":300,"upgrade_install":null,"values":null,"verify":false,"version":"13.2.12","wait":true,"wait_for_jobs":false},"after_unknown":{"id":true,"manifest":true,"metadata":true,"postrender":[],"set":[{},{},{},{}],"set_list":[],"set_sensitive":[]},"before_sensitive":false,"after_sensitive":{"metadata":[],"postrender":[],"repository_password":true,"set":[{},{},{},{}],"set_list":[],"set_sensitive":[]}}}],"configuration":{"provider_config":{"helm":{"name":"helm","full_name":"registry.terraform.io/hashicorp/helm"}},"root_module":{"resources":[{"address":"helm_release.nginx","mode":"managed","type":"helm_release","name":"nginx","provider_config_key":"helm","expressions":{"chart":{"constant_value":"nginx"},"name":{"constant_value":"my-nginx"},"repository":{"constant_value":"https://charts.bitnami.com/bitnami"},"version":{"constant_value":"13.2.12"}},"schema_version":1}],"variables":{"environment":{}}}},"timestamp":"2025-01-22T19:13:07Z","applyable":true,"complete":true,"errored":false}
diff --git a/providers/terraform/connection/tfplan.go b/providers/terraform/connection/tfplan.go
index 52d0b03aef..374ddd9893 100644
--- a/providers/terraform/connection/tfplan.go
+++ b/providers/terraform/connection/tfplan.go
@@ -19,11 +19,13 @@ type Plan struct {
 	PriorState         json.RawMessage    `json:"prior_state,omitempty"`
 	Configuration      json.RawMessage    `json:"configuration,omitempty"`
 	PlannedValues      plannedStateValues `json:"planned_values,omitempty"`
-	Variables          variables          `json:"variables,omitempty"`
+	Variables          Variables          `json:"variables,omitempty"`
 	ResourceChanges    []ResourceChange   `json:"resource_changes,omitempty"`
 	ResourceDrift      []ResourceChange   `json:"resource_drift,omitempty"`
 	RelevantAttributes []resourceAttr     `json:"relevant_attributes,omitempty"`
 	OutputChanges      map[string]change  `json:"output_changes,omitempty"`
+	Applyable          bool               `json:"applyable,omitempty"`
+	Errored            bool               `json:"errored,omitempty"`
 }
 
 type plannedStateValues struct {
@@ -83,9 +85,9 @@ type resource struct {
 	SensitiveValues json.RawMessage `json:"sensitive_values,omitempty"`
 }
 
-type variables map[string]*variable
+type Variables map[string]*Variable
 
-type variable struct {
+type Variable struct {
 	Value json.RawMessage `json:"value,omitempty"`
 }
 
diff --git a/providers/terraform/connection/tfplan_test.go b/providers/terraform/connection/tfplan_test.go
index 6cd5775c41..2dbb80eba0 100644
--- a/providers/terraform/connection/tfplan_test.go
+++ b/providers/terraform/connection/tfplan_test.go
@@ -21,3 +21,17 @@ func TestTfplan(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotNil(t, plan)
 }
+
+func TestTfWithDynamicBlocksAndVariables(t *testing.T) {
+	data, err := os.ReadFile("./testdata/dynamic_block/tfplan.json")
+	require.NoError(t, err)
+
+	var plan Plan
+	err = json.Unmarshal(data, &plan)
+	require.NoError(t, err)
+	assert.NotNil(t, plan)
+	_, ok := plan.Variables["environment"] // this exist in the testdata
+	assert.True(t, ok)
+	assert.True(t, plan.Applyable)
+	assert.False(t, plan.Errored)
+}
diff --git a/providers/terraform/resources/terraform.lr b/providers/terraform/resources/terraform.lr
index 430bdb3563..a7918970e0 100644
--- a/providers/terraform/resources/terraform.lr
+++ b/providers/terraform/resources/terraform.lr
@@ -167,6 +167,12 @@ terraform.plan {
   terraformVersion string
   // Resource changes
   resourceChanges() []terraform.plan.resourceChange
+  // Variables used to generate the Terraform plan
+  variables []terraform.plan.variable
+  // Whether `apply` is valid for the plan
+  applyable bool
+  // Whether the plan errored
+  errored bool
 }
 
 // Terraform plan configuration
@@ -177,6 +183,14 @@ terraform.plan.configuration {
   resources() []dict
 }
 
+// Terraform plan variable
+terraform.plan.variable @defaults("name value") {
+  // Variable name
+  name string
+  // Variable value
+  value dict
+}
+
 // Terraform plan resource change
 terraform.plan.resourceChange @defaults("type name") {
   // Resource address
diff --git a/providers/terraform/resources/terraform.lr.go b/providers/terraform/resources/terraform.lr.go
index 8d65d5479e..5ed7840516 100644
--- a/providers/terraform/resources/terraform.lr.go
+++ b/providers/terraform/resources/terraform.lr.go
@@ -65,6 +65,10 @@ func init() {
 			// to override args, implement: initTerraformPlanConfiguration(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error)
 			Create: createTerraformPlanConfiguration,
 		},
+		"terraform.plan.variable": {
+			// to override args, implement: initTerraformPlanVariable(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error)
+			Create: createTerraformPlanVariable,
+		},
 		"terraform.plan.resourceChange": {
 			// to override args, implement: initTerraformPlanResourceChange(runtime *plugin.Runtime, args map[string]*llx.RawData) (map[string]*llx.RawData, plugin.Resource, error)
 			Create: createTerraformPlanResourceChange,
@@ -318,12 +322,27 @@ var getDataFields = map[string]func(r plugin.Resource) *plugin.DataRes{
 	"terraform.plan.resourceChanges": func(r plugin.Resource) *plugin.DataRes {
 		return (r.(*mqlTerraformPlan).GetResourceChanges()).ToDataRes(types.Array(types.Resource("terraform.plan.resourceChange")))
 	},
+	"terraform.plan.variables": func(r plugin.Resource) *plugin.DataRes {
+		return (r.(*mqlTerraformPlan).GetVariables()).ToDataRes(types.Array(types.Resource("terraform.plan.variable")))
+	},
+	"terraform.plan.applyable": func(r plugin.Resource) *plugin.DataRes {
+		return (r.(*mqlTerraformPlan).GetApplyable()).ToDataRes(types.Bool)
+	},
+	"terraform.plan.errored": func(r plugin.Resource) *plugin.DataRes {
+		return (r.(*mqlTerraformPlan).GetErrored()).ToDataRes(types.Bool)
+	},
 	"terraform.plan.configuration.providerConfig": func(r plugin.Resource) *plugin.DataRes {
 		return (r.(*mqlTerraformPlanConfiguration).GetProviderConfig()).ToDataRes(types.Array(types.Dict))
 	},
 	"terraform.plan.configuration.resources": func(r plugin.Resource) *plugin.DataRes {
 		return (r.(*mqlTerraformPlanConfiguration).GetResources()).ToDataRes(types.Array(types.Dict))
 	},
+	"terraform.plan.variable.name": func(r plugin.Resource) *plugin.DataRes {
+		return (r.(*mqlTerraformPlanVariable).GetName()).ToDataRes(types.String)
+	},
+	"terraform.plan.variable.value": func(r plugin.Resource) *plugin.DataRes {
+		return (r.(*mqlTerraformPlanVariable).GetValue()).ToDataRes(types.Dict)
+	},
 	"terraform.plan.resourceChange.address": func(r plugin.Resource) *plugin.DataRes {
 		return (r.(*mqlTerraformPlanResourceChange).GetAddress()).ToDataRes(types.String)
 	},
@@ -670,6 +689,18 @@ var setDataFields = map[string]func(r plugin.Resource, v *llx.RawData) bool {
 		r.(*mqlTerraformPlan).ResourceChanges, ok = plugin.RawToTValue[[]interface{}](v.Value, v.Error)
 		return
 	},
+	"terraform.plan.variables": func(r plugin.Resource, v *llx.RawData) (ok bool) {
+		r.(*mqlTerraformPlan).Variables, ok = plugin.RawToTValue[[]interface{}](v.Value, v.Error)
+		return
+	},
+	"terraform.plan.applyable": func(r plugin.Resource, v *llx.RawData) (ok bool) {
+		r.(*mqlTerraformPlan).Applyable, ok = plugin.RawToTValue[bool](v.Value, v.Error)
+		return
+	},
+	"terraform.plan.errored": func(r plugin.Resource, v *llx.RawData) (ok bool) {
+		r.(*mqlTerraformPlan).Errored, ok = plugin.RawToTValue[bool](v.Value, v.Error)
+		return
+	},
 	"terraform.plan.configuration.__id": func(r plugin.Resource, v *llx.RawData) (ok bool) {
 			r.(*mqlTerraformPlanConfiguration).__id, ok = v.Value.(string)
 			return
@@ -682,6 +713,18 @@ var setDataFields = map[string]func(r plugin.Resource, v *llx.RawData) bool {
 		r.(*mqlTerraformPlanConfiguration).Resources, ok = plugin.RawToTValue[[]interface{}](v.Value, v.Error)
 		return
 	},
+	"terraform.plan.variable.__id": func(r plugin.Resource, v *llx.RawData) (ok bool) {
+			r.(*mqlTerraformPlanVariable).__id, ok = v.Value.(string)
+			return
+		},
+	"terraform.plan.variable.name": func(r plugin.Resource, v *llx.RawData) (ok bool) {
+		r.(*mqlTerraformPlanVariable).Name, ok = plugin.RawToTValue[string](v.Value, v.Error)
+		return
+	},
+	"terraform.plan.variable.value": func(r plugin.Resource, v *llx.RawData) (ok bool) {
+		r.(*mqlTerraformPlanVariable).Value, ok = plugin.RawToTValue[interface{}](v.Value, v.Error)
+		return
+	},
 	"terraform.plan.resourceChange.__id": func(r plugin.Resource, v *llx.RawData) (ok bool) {
 			r.(*mqlTerraformPlanResourceChange).__id, ok = v.Value.(string)
 			return
@@ -1732,6 +1775,9 @@ type mqlTerraformPlan struct {
 	FormatVersion plugin.TValue[string]
 	TerraformVersion plugin.TValue[string]
 	ResourceChanges plugin.TValue[[]interface{}]
+	Variables plugin.TValue[[]interface{}]
+	Applyable plugin.TValue[bool]
+	Errored plugin.TValue[bool]
 }
 
 // createTerraformPlan creates a new instance of this resource
@@ -1795,6 +1841,18 @@ func (c *mqlTerraformPlan) GetResourceChanges() *plugin.TValue[[]interface{}] {
 	})
 }
 
+func (c *mqlTerraformPlan) GetVariables() *plugin.TValue[[]interface{}] {
+	return &c.Variables
+}
+
+func (c *mqlTerraformPlan) GetApplyable() *plugin.TValue[bool] {
+	return &c.Applyable
+}
+
+func (c *mqlTerraformPlan) GetErrored() *plugin.TValue[bool] {
+	return &c.Errored
+}
+
 // mqlTerraformPlanConfiguration for the terraform.plan.configuration resource
 type mqlTerraformPlanConfiguration struct {
 	MqlRuntime *plugin.Runtime
@@ -1853,6 +1911,60 @@ func (c *mqlTerraformPlanConfiguration) GetResources() *plugin.TValue[[]interfac
 	})
 }
 
+// mqlTerraformPlanVariable for the terraform.plan.variable resource
+type mqlTerraformPlanVariable struct {
+	MqlRuntime *plugin.Runtime
+	__id string
+	// optional: if you define mqlTerraformPlanVariableInternal it will be used here
+	Name plugin.TValue[string]
+	Value plugin.TValue[interface{}]
+}
+
+// createTerraformPlanVariable creates a new instance of this resource
+func createTerraformPlanVariable(runtime *plugin.Runtime, args map[string]*llx.RawData) (plugin.Resource, error) {
+	res := &mqlTerraformPlanVariable{
+		MqlRuntime: runtime,
+	}
+
+	err := SetAllData(res, args)
+	if err != nil {
+		return res, err
+	}
+
+	if res.__id == "" {
+	res.__id, err = res.id()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if runtime.HasRecording {
+		args, err = runtime.ResourceFromRecording("terraform.plan.variable", res.__id)
+		if err != nil || args == nil {
+			return res, err
+		}
+		return res, SetAllData(res, args)
+	}
+
+	return res, nil
+}
+
+func (c *mqlTerraformPlanVariable) MqlName() string {
+	return "terraform.plan.variable"
+}
+
+func (c *mqlTerraformPlanVariable) MqlID() string {
+	return c.__id
+}
+
+func (c *mqlTerraformPlanVariable) GetName() *plugin.TValue[string] {
+	return &c.Name
+}
+
+func (c *mqlTerraformPlanVariable) GetValue() *plugin.TValue[interface{}] {
+	return &c.Value
+}
+
 // mqlTerraformPlanResourceChange for the terraform.plan.resourceChange resource
 type mqlTerraformPlanResourceChange struct {
 	MqlRuntime *plugin.Runtime
diff --git a/providers/terraform/resources/terraform.lr.manifest.yaml b/providers/terraform/resources/terraform.lr.manifest.yaml
index bd67ac9ea5..fb131bbddd 100755
--- a/providers/terraform/resources/terraform.lr.manifest.yaml
+++ b/providers/terraform/resources/terraform.lr.manifest.yaml
@@ -87,9 +87,15 @@ resources:
       title: Display all loaded Terraform modules
   terraform.plan:
     fields:
+      applyable:
+        min_mondoo_version: 9.0.0
+      errored:
+        min_mondoo_version: 9.0.0
       formatVersion: {}
       resourceChanges: {}
       terraformVersion: {}
+      variables:
+        min_mondoo_version: 9.0.0
     min_mondoo_version: latest
     platform:
       name:
@@ -132,6 +138,14 @@ resources:
     platform:
       name:
       - terraform-plan
+  terraform.plan.variable:
+    fields:
+      name: {}
+      value: {}
+    min_mondoo_version: 9.0.0
+    platform:
+      name:
+      - terraform-plan
   terraform.settings:
     fields:
       backend:
diff --git a/providers/terraform/resources/tfplan.go b/providers/terraform/resources/tfplan.go
index 0672923a60..3ec1d9e3ca 100644
--- a/providers/terraform/resources/tfplan.go
+++ b/providers/terraform/resources/tfplan.go
@@ -40,6 +40,12 @@ func initTerraformPlan(runtime *plugin.Runtime, args map[string]*llx.RawData) (m
 
 	args["formatVersion"] = llx.StringData(plan.FormatVersion)
 	args["terraformVersion"] = llx.StringData(plan.TerraformVersion)
+	args["applyable"] = llx.BoolData(plan.Applyable)
+	args["errored"] = llx.BoolData(plan.Errored)
+	args["variables"] = llx.ArrayData(
+		variablesToArrayInterface(runtime, plan.Variables),
+		types.Resource("terraform.plan.variables"),
+	)
 
 	return args, nil, nil
 }
@@ -153,6 +159,11 @@ func (t *mqlTerraformPlanConfiguration) id() (string, error) {
 	return "terraform.plan.configuration", nil
 }
 
+func (t *mqlTerraformPlanVariable) id() (string, error) {
+	id := t.Name
+	return "terraform.plan.variable/name/" + id.Data, nil
+}
+
 type PlanConfiguration struct {
 	ProviderConfig map[string]json.RawMessage `json:"provider_config"`
 	RootModule     struct {
@@ -223,3 +234,25 @@ func (t *mqlTerraformPlanConfiguration) resources() ([]interface{}, error) {
 	}
 	return res, nil
 }
+
+func variablesToArrayInterface(runtime *plugin.Runtime, variables connection.Variables) []interface{} {
+	var list []interface{}
+	for k, v := range variables {
+		var value interface{}
+		err := json.Unmarshal(v.Value, &value)
+		if err != nil {
+			continue
+		}
+		variable, err := CreateResource(runtime, "terraform.plan.variable", map[string]*llx.RawData{
+			"name":  llx.StringData(k),
+			"value": llx.AnyData(value),
+		})
+		if err != nil {
+			continue
+		}
+
+		list = append(list, variable)
+	}
+
+	return list
+}