Confusion on which services/requests should be proxied to real AWS and which should not

[wr-cdargis]

1. If I have read_only set to true for dynamodb, and I have specified resources that I want proxied - what happens to a read request that comes in for a resource I haven't specified? Should it not get proxied out? Currently the behavior is that it does.
2. If I haven't configured any specific services to be proxied, will all requests then be proxied?
3. How can I proxy just requests for specific dynamo tables? The following config proxies all requests regardless of which table. If I make a read request for Table3 it will succeed. It's not until I completely remove the dynamo configuration that it fails.

services:
  dynamodb:
    resources:
    - .*TableOne
    - .*TableTwo