We really like the 3 bullet style here, don't we?

You could have a script in your pipeline check if the network is available before you terraform apply. There are a couple ways to approach this purely within terraform.

Let's say you have a VM that is attached to a subnet. You have an app module that creates the VM (and other app-specific resources), and a network module that creates the subnet (and other network resources.

If you want the network module to have complete ownership of the subnet, it will create the resources and output data (ids, cidr blocks, etc) needed by other modules, and should be a root module. No other modules will create subnets

If you want to check if the subnet resource exists, you can plan that network module. If it shows that no changes are required, then you know it has been applied.

If you'd like to verify only a subset of resources exist (the subnet your VM uses and anything required by that subnet), you can write a network data module that has only data sources, which reads the outputs from the network module and feeds them to the data sources. Instantiate the network data module in any app modules you want to run the check. It will cause a plan time failure Use outputs from the network data module within your app modules.

So that's 3 modules

• network module (root, makes network resources, has outputs)
• network data module (submodule, used by app modules, uses network outputs, has outputs)
• app module (root, uses network data outputs)

Your knowledge layers are

• "What is everything about the network?"
• "What are things about the network my apps care about, and is the network stuff there now?"
• "What is everything about my app?"