Terraform Module Dependency Map from Stack Inventory (No Invented Apply Seconds)

Prompt

Act as a Terraform stack cartographer who only uses a pasted stack inventory. You write a module dependency map the inventory already supports. You do not invent apply seconds, state lock IDs, provider credentials, or private registry tokens not in Inputs. This is not a Terraform Cloud billing estimate and not an apply-time certificate.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.

Inputs:
- Stack module inventory I lock (module stubs, resource cues, output notes): [Inventory]
- Terraform / provider version notes I lock: [Version]
- Workspace or stack label I may quote (or UNKNOWN): [Workspace]
- Required module or stack names I may quote (or UNKNOWN): [SpecNames]
- Module source titles already present (or UNKNOWN): [ModuleCues]
- Resource and data cues already present (or UNKNOWN): [ResourceCues]
- Output and dependency notes already present (or UNKNOWN): [DepNotes]
- Words I must not use: [Banned]
- What I must never invent (apply seconds, state lock IDs, provider credentials, registry tokens): [Never]
- Output format: [Format]
- Language: [Lang]

Generate:
1. Honesty ledger: Inventory nouns, Version, Workspace, SpecNames, ModuleCues, ResourceCues, DepNotes, Lang. Forbidden: invented apply seconds, state lock IDs, provider credentials, registry tokens. Banner: not a Terraform Cloud billing estimate; not an apply-time certificate.
2. Dependency map table: one row per Inventory module stub or resource cue. Missing DepNotes write NOT IN INPUTS. Use Terraform modules, resources, data sources, outputs, and depends_on language when Inventory supports it. Never print apply-second or state-lock VALUES not in Inventory.
3. Spec name set: only names in SpecNames. Unnamed modules stay NOT IN INPUTS. Never invent credential VALUES not in Inventory.
4. Version lock: print Version. Refuse Terraform features newer than Version if Version is named.
5. Refuse list: inventing apply seconds, inventing state lock IDs, inventing provider credentials, inventing registry tokens.
6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format.

Constraints:
- Map from Inventory only. No invented apply-second VALUES. Teach Terraform module dependency mapping, not a Pulumi or CloudFormation swap.
- Honor Version. No emojis.

Instructions

Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.

Generated Output

This image was generated using the prompt above.

Terraform Module Dependency Map from Stack Inventory (No Invented Apply Seconds) - Result

Examples

Example Input

Inventory: module Harbor Quay Network as pasted resource cue aws_vpc.main as pasted dep notes depends_on aws_internet_gateway.igw as pasted; module River Ops Compute as pasted resource cue aws_instance.bastion as pasted. Apply invent NONE. Lock invent NONE.
Version: Terraform 1.9 as pasted (do not invent unreleased AI plan writer)
Workspace: Harbor Quay prod stack as pasted
SpecNames: Network dependency map as pasted; Compute dependency map as pasted. Registry token UNKNOWN.
ModuleCues: Network as pasted; Compute as pasted. Data UNKNOWN.
ResourceCues: aws_vpc.main as pasted; aws_instance.bastion as pasted. aws_s3_bucket.logs UNKNOWN.
DepNotes: depends_on aws_internet_gateway.igw as pasted. Apply second VALUES NOT IN INPUTS.
Banned: guaranteed apply, apply invent, lock invent, token invent
Never: invent apply seconds, invent state lock IDs, invent provider credentials, invent registry tokens
Format: ledger + table + specs + version + refuse + compliance
Lang: English

Example Output

1. Ledger. Inventory: module Harbor Quay Network resource cue aws_vpc.main dep notes depends_on aws_internet_gateway.igw; module River Ops Compute resource cue aws_instance.bastion. Apply invent NONE. Lock invent NONE. Version Terraform 1.9. Workspace Harbor Quay prod stack. SpecNames Network dependency map; Compute dependency map; Registry token UNKNOWN. ModuleCues Network; Compute; Data UNKNOWN. ResourceCues aws_vpc.main; aws_instance.bastion; aws_s3_bucket.logs UNKNOWN. DepNotes depends_on aws_internet_gateway.igw; Apply second VALUES NOT IN INPUTS. Lang English. Banner: not a Terraform Cloud billing estimate; not an apply-time certificate. Forbidden: invented apply seconds, state lock IDs, provider credentials, registry tokens, guaranteed apply, apply invent, lock invent, token invent.

3. Spec name set. Network dependency map; Compute dependency map as SpecNames. Registry token UNKNOWN so write registry token NOT IN INPUTS. No apply-second VALUES beyond Inventory. No third module invented.

4. Version lock. Terraform 1.9 as pasted. Unreleased AI plan writer not used. Provider credential packs NOT IN INPUTS.

5. Refuse. Apply invent: refused. Lock invent: refused. Credential invent: refused. Token invent: refused. Guaranteed apply: refused.

6. Compliance. Banned hits none. Format ledger+table+specs+version+refuse+compliance. Gaps: registry token policy, Data ModuleCues, aws_s3_bucket.logs ResourceCues, apply second VALUES DepNotes, remote state backend if any.

Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.