terraform-provider-azuread: Error: Deleting access package resource and catalog association

Context

When we try to delete our access package

Terraform (and AzureAD Provider) Version

2.37

Affected Resource(s)

• azuread_access_package_resource_package_association

Terraform Configuration Files

resource "azuread_group" "membership_group" {
  display_name     = "TFMembershipGroup"
  security_enabled = true

  members = [
    data.azuread_user.user01.object_id,
    data.azuread_user.user02.object_id,
  ]
}

data "azuread_user" "user01" {
  mail_nickname = "AdeleV"
}

data "azuread_user" "user02" {
  mail_nickname = "AlexW"
}

resource "azuread_group" "elevated_approvers_group" {
  display_name     = "TFElevatedApproversGroup"
  security_enabled = true
}

data "azuread_groups" "security_groups" {
  display_names = ["DATALAKE_RO"]
}

resource "azuread_group" "security_created_group" {
  display_name     = "TFSecurityGroup01"
  security_enabled = true
  
}

# For existing group, spn needs to be owner of the group
data "azuread_group" "security_group" {
  display_name = "DATALAKE_RW"
}

data "azuread_group" "security_group_ro" {
  display_name = "DATALAKE_RO"
}

resource "azuread_access_package_catalog" "test_catalog" {
  display_name = "azuread_access_package_catalog"
  description  = "TestAcc Catalog %[1]d for access assignment policy"
}

resource "azuread_access_package" "test_access_package" {
  display_name = "azuread_access_package"
  description  = "TestAcc Access Package %[1]d for access assignment policy"
  catalog_id   = azuread_access_package_catalog.test_catalog.id
  # resource_role_scope_id = "/providers/Microsoft.Management/managementGroups/00000000-0000-0000-0000-000000000000"
}

resource "azuread_access_package_assignment_policy" "test_access_package_assignment_policy_3" {
  display_name      = "azuread_access_package_assignment_policy_3"
  description       = "TestAcc Access Package Assignnment Policy 3"
  duration_in_days  = 1
  access_package_id = azuread_access_package.test_access_package.id
  requestor_settings {
    scope_type      = "SpecificDirectorySubjects"
    requests_accepted = true
    requestor {
      object_id    = azuread_group.membership_group.object_id
      subject_type = "groupMembers"
    }
  }

  approval_settings {
    approval_required = true
    approval_stage {
      approval_timeout_in_days = 5
      primary_approver {
        object_id    = azuread_group.elevated_approvers_group.object_id
        subject_type = "groupMembers"
      }
    }
  }
}

# List of Approved resources 
resource "azuread_access_package_resource_catalog_association" "example" {
  catalog_id             = azuread_access_package_catalog.test_catalog.id
  resource_origin_id     = azuread_group.security_created_group.object_id
  resource_origin_system = "AadGroup"
  # subject_type           = "groupMembers"
}

resource "azuread_access_package_resource_catalog_association" "access_to_existing_group" {
  catalog_id             = azuread_access_package_catalog.test_catalog.id
  resource_origin_id     = data.azuread_group.security_group.object_id
  resource_origin_system = "AadGroup"
}

resource "azuread_access_package_resource_catalog_association" "access_to_existing_group_ro" {
  catalog_id             = azuread_access_package_catalog.test_catalog.id
  resource_origin_id     = data.azuread_group.security_group_ro.object_id
  resource_origin_system = "AadGroup"
}

resource "azuread_access_package_resource_package_association" "example" {
  access_package_id               = azuread_access_package.test_access_package.id
  catalog_resource_association_id = azuread_access_package_resource_catalog_association.example.id
}

Debug Output

│ Error: Deleting access package resource and catalog association with resource “GUID”@“AadGroup” and catalog id “GUID”. 288│ 289│ AccessPackageResourceRequestClient.BaseClient.Post(): unexpected status 400 290│ with OData error: InvalidDeleteResourceHasEntitlements: The resource: 291│ {ResourceName} can not be deleted because there are active 292│ entitlements.

Expected Behavior

terraform destroy all the resources

Actual Behavior

When resources are deleted, we have a 400 on the delation of the object azuread_access_package_resource_package_association

Steps to Reproduce

with code below do :

1. terraform apply
2. terraform destroy

Important Factoids

Azure public cloud Proper permission with role and permission

References

https://github.com/hashicorp/terraform-provider-azuread/pull/903