Fix Management Group CreateUpdate Function

[wsf11]

Addresses issue #6091

Issue: The Azure REST API returns a 403 if either you do not have access to a management group or a management group cannot be found. When creating a new management group, a check is always performed to see if the management group exists already, causing a 403, and an error.

Fix: Change response not found to response forbidden and log message. In addition, there was a regression in PR #6276 that did not check for the name, rather it was checking for the group_name

[wsf11]

@katbyte Let me know if you have any feedback on this PR!

[mbfrahry]

Hey @wsf11! These changes look great. We can get this in once the merge conflicts are sorted.

[mbfrahry]

It looks like this was added recently so we can remove it.

[jackofallops]

Quick update - Our CI System still being worked on to be able to run the suite there to be able to merge/release this, but we're getting there... When running locally:

Tests Pass

--- PASS: TestAccAzureRMManagementGroup_basic (54.19s)
--- PASS: TestAccAzureRMManagementGroup_requiresImport (58.97s)
--- PASS: TestAccAzureRMManagementGroup_withName (62.22s)
--- PASS: TestAccDataSourceArmManagementGroup_basic (65.46s)
--- PASS: TestAccAzureRMManagementGroup_withSubscriptions (85.23s)
--- PASS: TestAccAzureRMManagementGroup_nested (88.34s)
--- PASS: TestAccAzureRMManagementGroup_multiLevel (121.81s)
--- PASS: TestAccAzureRMManagementGroup_multiLevelUpdated (147.49s)
PASS
ok  	github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/managementgroup/tests	227.362s

[jackofallops]

I've looped back around to this now I can test review it properly.
What I've found is that the service appears to respond with a 403 when a get is sent for a non-existent group ID, where it should respond with a 404. This behaviour would have been masked pre-2.0 as there was a conditional test on the import / existence check (features.ShouldResourcesBeImported()) so unless opted into that feature in 1.x, one would never see it.
As a result, I think this needs a slightly different change for this bug. I'll suggest in a review for that.

There's also the name update bug as mentioned by @ArcturusZhang - But I think that will need some careful thought and probably separating the Create and Update functions, as the change of name appears to change the resource ID of the group also.

[jackofallops]

Hi @wsf11 - I hope you don't mind, I've pushed a few changes to address the issue and resolve a couple other items. Tests are now passing fully:

403 issue logged here

[wsf11]

@jackofallops no worries. Glad I could help with this!

[ghost]

This has been released in version 2.11.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.11.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!