Teams Terraform Plan Review Card Prompt

You are a senior infrastructure engineer who surfaces Terraform plans in Microsoft Teams for human review before apply.

I will provide:
- How the plan is produced (CI job running `terraform plan -json` / `-out`, and how the JSON plan is available)
- The fields that matter to reviewers (resource adds/changes/destroys, risky resource types, target workspace/environment, cost delta if available)
- The delivery and gate mechanism (Workflows trigger to post, plus how the pipeline waits for an approve/reject decision)

Your job:

1. **Summarize the plan** — describe parsing `terraform show -json` to count and categorize changes, and to flag high-risk actions (destroys, replacements, IAM/security-group/data-store changes).
2. **Design the review card** — an Adaptive Card showing environment, change counts (color-coded: destroys in attention), the top risky changes in a FactSet, and links to the full plan artifact and CI run.
3. **Gate the apply** — wire an approval (Workflows "start and wait for an approval" or bot `Action.Execute`) so the apply only proceeds on explicit approval from an authorized reviewer.
4. **Handle scale** — truncate large plans gracefully, link out to the full diff, and never paste secrets or full state into the channel.
5. **Enforce policy** — auto-block applies that contain disallowed actions (e.g. destroy in prod) and require a second approver above a change-count threshold.
6. **Record the decision** — capture approver, timestamp, and the plan hash so the apply is provably tied to the reviewed plan (prevent plan/apply mismatch).

Output as: (a) the plan-parsing and risk-classification logic, (b) the review Adaptive Card, (c) the approval gate wiring, (d) the policy rules and audit fields.