How to Write a Terraform Module README Locked to a Provider Version
Module READMEs rot when someone writes hashicorp/aws latest and an example that calls a resource the pin does not have. Apply fails in a fork you do not own. The docs were the bug.
The matching generator is the Terraform Module README and Examples Locked to Provider Version prompt. Browse related cards in the PromptDig library (Browse more prompts). When a filled run survives, share the version you actually use (Share a prompt).
Print the pin before the prose
Write a Terraform module README plus examples pinned to a named provider version. No invented resources, outputs, or newer provider APIs. Start by filling Inputs, not by asking the model to remember last week's run. If a field is blank, write NONE or NOT IN INPUTS and leave it blank through Generate. The card is built so the model cannot honestly invent a number, owner, URL, or command that you did not paste.
Paste these fields before you hit run:
Module name and source path: [Module]
Terraform version constraint: [TfVer]
Provider name and exact version pin: [Provider]
Variables with type, default, and description: [Vars]
Resources the module actually creates: [Resources]
Outputs with names and descriptions: [Outputs]
Required IAM or cloud permissions I can prove: [Perms]
Example call sites I allow (count): [Examples]
Known limitations: [Limits]
Words I must not use: [Banned]
That inventory is the honesty ledger. Anything that does not appear there is forbidden in the draft. If you catch yourself adding a nice-to-have after the run, you are no longer using the card. You are ghostwriting. Put the extra fact in Inputs and run again.
Document only variables and outputs you were given
Generate is numbered on purpose. Do not skip a step because the first paragraph looked done. The early steps exist to stop later prose from smuggling claims.
Walk the Generate list in order:
- Version lock: quote TfVer and Provider. List APIs you refuse because they are newer than the pin.
- README title, short description, and a requirements table (Terraform, provider, pin).
- Usage example: a complete module block using only Vars. No extra arguments.
- Inputs table and Outputs table from Vars and Outputs only. Mark missing descriptions as NOT IN INPUTS.
- Resources section: one line per item in Resources. Do not add a data source that was not listed.
- Examples folder sketch: filenames and what each example proves, count limited to Examples.
- Limitations and upgrade notes from Limits only.
- Compliance pass: quote Banned words, invented resources, or unpinned latest. Cut them.
If a step asks for a version lock, quote the version from Inputs in the output. If a step asks for a refuse list, keep the refuse list in the published artifact, not in a sidebar you delete. Reviewers should see what the model was not allowed to do.
Ship two examples, not a catalog
Most failures are the same shape: a missing field gets a confident fill. A conversion rate appears. A Gradle task appears. A flash point appears. A caption appears on a job that asked for slide text only. Your review is to search the draft for numbers, names, and commands, then grep Inputs. No match means cut.
Honor the constraints as hard stops, not vibes:
- HashiCorp Terraform 1.9.x language. Do not write OpenTofu-only features unless Inputs say OpenTofu.
- Provider version is a pin, not a range you widen.
- Never invent an output, variable, or resource address.
- Do not paste fake terraform plan output or invented apply times.
- Examples must apply with only the listed Vars.
When the card says not legal advice, not certification, not an exam dump, or not a caption engine, that sentence belongs at the top of the output. Deleting it to look more finished is how you inherit risk.
List the limitations as loudly as the usage block
Finish with the compliance pass the prompt already asks for. Quote the banned-word hits. Cut them. Print character counts when the job has a cap. Print word counts when the job has a budget. List gaps as gaps. Five missing facts are more useful than one smooth paragraph.
Tags on the card (terraform module readme, hashicorp terraform provider pin, terraform examples version lock) are a reminder of the job shape, not an invitation to wander into a neighboring cluster. If you need a different surface, open a different PromptDig card rather than stretching this one.
Fill the card, then run
Replace every bracket. Run on ChatGPT, Claude, or Gemini. Read the ledger first, then the artifact. If the model invents a commit, KPI, DOI, PEL, bid, or logo, discard the run. Tighten Inputs. Run again. Share the filled card that survived, not the first draft that sounded done.