Terraform Module Structure Review

Review your Terraform or other IaC layout for module boundaries, duplication, variable hygiene and state separation by environment.

Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

Review my infrastructure-as-code layout. Directory structure: [DIRECTORY_TREE]. Tool and version: [IAC_TOOL_VERSION]. Environments and accounts: [ENVIRONMENTS]. How state is stored and locked: [STATE_BACKEND].

Evaluate: module boundaries, duplication across environments, variable and output hygiene, state separation per environment, blast radius of a single apply, and drift detection. Give findings in a table with Finding | Why it matters | Severity | Suggested change | Effort. Propose a target structure as an indented tree with a one-line purpose for each directory and an example of a module interface with inputs and outputs in pseudo-code. Add a safe refactoring procedure for moving resources between states without recreating them, flagged for testing in a non-production environment first.

Add a section on safety nets I should have before touching anything: state backups, a read-only plan in CI, locking, and a documented break-glass process. Summarise the highest-risk three findings in plain language that a non-engineer manager could understand, with the potential impact of each, and propose which single change gives the largest reduction in blast radius.

Add a worked example of one finding written in full: a module that creates a database, its security group and a monitoring dashboard together. Describe why the blast radius is too large, show the proposed split into three modules with their inputs and outputs as pseudo-code, and give the migration steps using state moves, each with the plan result you should expect (no changes, zero destroys). Add a pre-flight checklist for any state operation: backup taken and tested, lock confirmed, plan reviewed by a second person, window agreed, rollback described. Provide a scoring sheet of ten structural qualities with a score from 0 to 2 so I can re-run the review in six months and see whether the layout has improved. End with a list of three small structural changes that could be made this week without touching live state, ranked by how much they reduce confusion for the team.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

Finding | Why | Severity | Change | Effort
One state for all environments | Blast radius: a staging apply can touch production | High | State per environment | 2 days
Copy-pasted network config in 3 envs | Drift | Medium | Shared module | 1 day
Outputs expose secrets | Risk in logs | High | Mark sensitive | 1 hour
Target structure
modules/network, modules/database
envs/dev, envs/staging, envs/prod
Safety: back up state, run read-only plans in CI, use locking, document break-glass access.
Move resources with state commands, tested in dev first.

• IAC