Know that it will fail. I mean, how often are you making changes anyway??? When it fails, replay the build and hit it again. Hit it twice to make it nice.

Some instances cannot be resolved with a depends_on like moving a subnet from one NAT gateway to another. No way around it, you have a 10-second outage and you have to apply twice. -target on the one you're removing it from and subsequent -target on the one that is receiving will reduce the outage...

Use a newer version of terraform:
https://developer.hashicorp.com/terraform/language/meta-arguments/depends_on
Note: Module support for depends_on was added in Terraform version 0.13, and prior versions can only use it with resources.