Repository: SAP/terraform-provider-btp
Pull request #513 (2023-11-06 08:20:06)

feat: remove state in case of 404 errors to enable recreation
## Purpose
Currently 404 responses are treated as unexpected errors. Thus whenever a external resource is deleted outside of the terraform provider the user would manually have to clear the state and recreate the instance. The expected behaviour would be to not throw an error in such cases, but gracefully remove the state from the resource. This is also whats recommended in the terraform [plugin development guide](https://developer.hashicorp.com/terraform/plugin/framework/resources/read#recommendations).

Besides the described use case of recreating deleted resources this behaviour makes integration with tools like [upjet](https://github.com/crossplane/upjet) impossible.

According to @v0lkc this was probably missed, as the development tools wheren't that mature when initially implementing this provider. I therefor went ahead to implement the desired behaviour as an example for the subaccount_trust_configuration resource in this PR and suggest to do likewise for any resource that generally support reading behaviour. I can offer to contribute here if required. The change is covered with a new test case as well.



## Does this introduce a breaking change?

```
[ ] Yes
[x] No
```

## Pull Request Type

What kind of change does this Pull Request introduce?
```
[ ] Bugfix
[x] Feature
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:
```

## How to Test

* Test the code via automated test

```bash
go test ./...
```


* Implement similar change for any resource that supports reading data from the API

```
...
```

## What to Check

Verify that the following are valid:
* Automated tests are executed successfully

## Other Information
Related links:
* https://developer.hashicorp.com/terraform/plugin/framework/resources/read#recommendations
* https://github.com/crossplane/upjet

## Checklist for reviewer

The following organizational tasks must be completed before merging this PR:

* [x] The PR is assigned to the Terraform project and a status is set (typically "in review").
* [x] The PR has the matching labels assigned to it.
* [x] The PR has a milestone assigned to it.
* [x] If the PR closes an issue, the issue is referenced.
* [x] Possible follow-up items are created and linked.


cla-assistant[bot]: [![CLA assistant check](https://cla-assistant.io/pull/badge/not_signed)](https://cla-assistant.io/SAP/terraform-provider-btp?pullRequest=513) <br/>Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our [Contributor License Agreement](https://cla-assistant.io/SAP/terraform-provider-btp?pullRequest=513) before we can accept your contribution.<br/><sub>You have signed the CLA already but the status is still pending? Let us [recheck](https://cla-assistant.io/check/SAP/terraform-provider-btp?pullRequest=513) it.</sub>
lechnerc77: Follow-up issue created: #514 

Patch:
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 5db5bd3..339824d 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -14,7 +14,7 @@ body:
     attributes:
       label: What version of Terraform are you using?
       description: What version of Terraform are you using?
-      placeholder: 0.1.0-beta1
+      placeholder: 0.6.0-beta1
     validations:
       required: true
   - type: dropdown
diff --git a/docs/index.md b/docs/index.md
index 5a45ac1..39bf7bb 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -15,7 +15,7 @@ terraform {
   required_providers {
     btp = {
       source  = "SAP/btp"
-      version = "0.5.0-beta1"
+      version = "0.6.0-beta1"
     }
   }
 }
diff --git a/examples/provider/provider.tf b/examples/provider/provider.tf
index 27e2f63..4d7dc73 100644
--- a/examples/provider/provider.tf
+++ b/examples/provider/provider.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     btp = {
       source  = "SAP/btp"
-      version = "0.5.0-beta1"
+      version = "0.6.0-beta1"
     }
   }
 }
diff --git a/internal/provider/fixtures/resource_subaccount_trust_configuration.error_notfound.yaml b/internal/provider/fixtures/resource_subaccount_trust_configuration.error_notfound.yaml
new file mode 100644
index 0000000..23830a7
--- /dev/null
+++ b/internal/provider/fixtures/resource_subaccount_trust_configuration.error_notfound.yaml
@@ -0,0 +1,1105 @@
+---
+version: 2
+interactions:
+  - id: 0
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 118
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"customIdp":"identityProvider","subdomain":"terraformintcanary","userName":"john.doe@int.test","password":"testUserPassword"}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - 1ab9cfc4-2912-2779-3c00-5338902122cd
+        X-Cpcli-Format:
+          - json
+      url: https://canary.cli.btp.int.sap/login/v2.49.0
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 153
+      uncompressed: false
+      body: '{"issuer":"identity.provider.test","refreshToken":"redacted","user":"john.doe@int.test","mail":"john.doe@int.test"}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "153"
+        Content-Type:
+          - application/json
+        Date:
+          - Fri, 20 Oct 2023 06:02:03 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - 3af374d9-661d-4dc4-4f97-a7e8997c34d8
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 322.4923ms
+  - id: 1
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 118
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"customIdp":"identityProvider","subdomain":"terraformintcanary","userName":"john.doe@int.test","password":"testUserPassword"}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - 05712539-cc9e-4ae1-c88f-a88d90a4e442
+        X-Cpcli-Format:
+          - json
+      url: https://canary.cli.btp.int.sap/login/v2.49.0
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 153
+      uncompressed: false
+      body: '{"issuer":"identity.provider.test","refreshToken":"redacted","user":"john.doe@int.test","mail":"john.doe@int.test"}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "153"
+        Content-Type:
+          - application/json
+        Date:
+          - Fri, 20 Oct 2023 06:02:04 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - 96dbab40-34a0-4a1e-774a-6d070e2d3cdf
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 283.6356ms
+  - id: 2
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 118
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"customIdp":"identityProvider","subdomain":"terraformintcanary","userName":"john.doe@int.test","password":"testUserPassword"}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - 95901095-fd70-3df6-d4f0-2eb145a995fe
+        X-Cpcli-Format:
+          - json
+      url: https://canary.cli.btp.int.sap/login/v2.49.0
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 153
+      uncompressed: false
+      body: '{"issuer":"identity.provider.test","refreshToken":"redacted","user":"john.doe@int.test","mail":"john.doe@int.test"}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "153"
+        Content-Type:
+          - application/json
+        Date:
+          - Fri, 20 Oct 2023 06:02:08 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - 2ad9f0a3-59f3-494f-7e72-1eff0924a1c3
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 4.4137035s
+  - id: 3
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 125
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"paramValues":{"iasTenantUrl":"terraformint.accounts400.ondemand.com","subaccount":"ef23ace8-6ade-4d78-9c1f-8df729548bbf"}}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - 7297516a-91ab-afbc-584e-0bfae41fd1a1
+        X-Cpcli-Customidp:
+          - identityProvider
+        X-Cpcli-Format:
+          - json
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Cpcli-Subdomain:
+          - terraformintcanary
+      url: https://canary.cli.btp.int.sap/command/v2.49.0/security/trust?create
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 0
+      uncompressed: false
+      body: ""
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "0"
+        Date:
+          - Fri, 20 Oct 2023 06:02:08 GMT
+        Expires:
+          - "0"
+        Location:
+          - https://cpcli.cf.eu12.hana.ondemand.com/command/v2.49.0/security/trust?create
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Subdomain:
+          - integration-test-acc-static-b8xxozer
+        X-Frame-Options:
+          - DENY
+        X-Id-Token:
+          - redacted
+        X-Vcap-Request-Id:
+          - ecd6bad4-3485-4e3c-4dd9-cbf0c98e47ea
+        X-Xss-Protection:
+          - "0"
+      status: 307 Temporary Redirect
+      code: 307
+      duration: 129.918ms
+  - id: 4
+    request:
+      proto: ""
+      proto_major: 0
+      proto_minor: 0
+      content_length: 125
+      transfer_encoding: []
+      trailer: {}
+      host: ""
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"paramValues":{"iasTenantUrl":"terraformint.accounts400.ondemand.com","subaccount":"ef23ace8-6ade-4d78-9c1f-8df729548bbf"}}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        Referer:
+          - https://canary.cli.btp.int.sap/command/v2.49.0/security/trust?create
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - 7297516a-91ab-afbc-584e-0bfae41fd1a1
+        X-Cpcli-Customidp:
+          - identityProvider
+        X-Cpcli-Format:
+          - json
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Cpcli-Subdomain:
+          - integration-test-acc-static-b8xxozer
+        X-Id-Token:
+          - redacted
+      url: https://cpcli.cf.eu12.hana.ondemand.com/command/v2.49.0/security/trust?create
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: -1
+      uncompressed: true
+      body: '{"type":"oidc1.0","config":{"emailDomain":null,"additionalConfiguration":null,"providerDescription":"IAS tenant terraformint.accounts400.ondemand.com (OpenID Connect)","externalGroupsWhitelist":[],"attributeMappings":{"user.attribute.groups":"groups","user.attribute.remoteEntityId":"iss","user_uuid":"user_uuid"},"addShadowUserOnLogin":true,"storeCustomAttributes":true,"authUrl":null,"tokenUrl":null,"tokenKeyUrl":null,"logoutUrl":null,"tokenKey":null,"linkText":"terraformint.accounts400.ondemand.com","showLinkText":true,"clientAuthInBody":false,"skipSslValidation":false,"relyingPartyId":"c03c5ec7-fca7-45ee-9a4f-d00ad2fdd0a8","scopes":["openid","email"],"issuer":"https://terraformint.accounts400.ondemand.com","responseType":"code","discoveryUrl":"https://terraformint.accounts400.ondemand.com/.well-known/openid-configuration","userInfoUrl":null,"passwordGrantEnabled":true,"setForwardHeader":true,"platformIdp":false,"applicationIdp":true,"iasTenant":{"host":"terraformint.accounts400.ondemand.com","adminUrl":"https://terraformint.accounts400.ondemand.com/admin/#/applications/653217e106c21011242f7443"},"neoAuthnWithOidc":false},"id":"447b1079-bcf5-4f19-8a34-7f548a113608","originKey":"sap.custom","name":"Custom IAS tenant","version":0,"created":1697781729834,"last_modified":1697781729834,"active":true,"identityZoneId":"ef23ace8-6ade-4d78-9c1f-8df729548bbf"}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Type:
+          - application/json
+        Date:
+          - Fri, 20 Oct 2023 06:02:09 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Backend-Mediatype:
+          - application/json
+        X-Cpcli-Backend-Status:
+          - "201"
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - db2ebfa9-543f-4665-67cb-6c83e82ed278
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 876.0339ms
+  - id: 5
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 230
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"paramValues":{"iasTenantUrl":"terraformint.accounts400.ondemand.com","originKey":"sap.custom","refreshTrust":"true","shadowUsers":"true","status":"active","subaccount":"ef23ace8-6ade-4d78-9c1f-8df729548bbf","userLogon":"true"}}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - c2b18146-40f0-8be8-f99b-2225eace75f2
+        X-Cpcli-Customidp:
+          - identityProvider
+        X-Cpcli-Format:
+          - json
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Cpcli-Subdomain:
+          - terraformintcanary
+      url: https://canary.cli.btp.int.sap/command/v2.49.0/security/trust?update
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 0
+      uncompressed: false
+      body: ""
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "0"
+        Date:
+          - Fri, 20 Oct 2023 06:02:09 GMT
+        Expires:
+          - "0"
+        Location:
+          - https://cpcli.cf.eu12.hana.ondemand.com/command/v2.49.0/security/trust?update
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Subdomain:
+          - integration-test-acc-static-b8xxozer
+        X-Frame-Options:
+          - DENY
+        X-Id-Token:
+          - redacted
+        X-Vcap-Request-Id:
+          - 5496eaf9-1f3e-47c1-58b4-60ff9d8e4610
+        X-Xss-Protection:
+          - "0"
+      status: 307 Temporary Redirect
+      code: 307
+      duration: 145.3411ms
+  - id: 6
+    request:
+      proto: ""
+      proto_major: 0
+      proto_minor: 0
+      content_length: 230
+      transfer_encoding: []
+      trailer: {}
+      host: ""
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"paramValues":{"iasTenantUrl":"terraformint.accounts400.ondemand.com","originKey":"sap.custom","refreshTrust":"true","shadowUsers":"true","status":"active","subaccount":"ef23ace8-6ade-4d78-9c1f-8df729548bbf","userLogon":"true"}}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        Referer:
+          - https://canary.cli.btp.int.sap/command/v2.49.0/security/trust?update
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - c2b18146-40f0-8be8-f99b-2225eace75f2
+        X-Cpcli-Customidp:
+          - identityProvider
+        X-Cpcli-Format:
+          - json
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Cpcli-Subdomain:
+          - integration-test-acc-static-b8xxozer
+        X-Id-Token:
+          - redacted
+      url: https://cpcli.cf.eu12.hana.ondemand.com/command/v2.49.0/security/trust?update
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: -1
+      uncompressed: true
+      body: '{"name":"Custom IAS tenant","originKey":"sap.custom","typeOfTrust":"Application","status":"active","description":"IAS tenant terraformint.accounts400.ondemand.com (OpenID Connect)","identityProvider":"terraformint.accounts400.ondemand.com","domain":null,"linkTextForUserLogon":"terraformint.accounts400.ondemand.com","availableForUserLogon":"true","createShadowUsersDuringLogon":"true","sapBtpCli":"terraformint","protocol":"OpenID Connect","readOnly":false}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Type:
+          - application/json
+        Date:
+          - Fri, 20 Oct 2023 06:02:10 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Backend-Mediatype:
+          - application/json
+        X-Cpcli-Backend-Status:
+          - "200"
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - d81c4773-ca53-4f77-5dd0-a91d467d4bb8
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 256.6515ms
+  - id: 7
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 118
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"customIdp":"identityProvider","subdomain":"terraformintcanary","userName":"john.doe@int.test","password":"testUserPassword"}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - 9994d283-4bc3-1d25-9773-71ae3945c5ce
+        X-Cpcli-Format:
+          - json
+      url: https://canary.cli.btp.int.sap/login/v2.49.0
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 153
+      uncompressed: false
+      body: '{"issuer":"identity.provider.test","refreshToken":"redacted","user":"john.doe@int.test","mail":"john.doe@int.test"}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "153"
+        Content-Type:
+          - application/json
+        Date:
+          - Fri, 20 Oct 2023 06:02:14 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - 0a9b219c-8550-4ee1-5ca1-dd6565828e25
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 3.815721s
+  - id: 8
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 118
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"customIdp":"identityProvider","subdomain":"terraformintcanary","userName":"john.doe@int.test","password":"testUserPassword"}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - d5931788-9830-46a7-9ed2-8b68a0207e85
+        X-Cpcli-Format:
+          - json
+      url: https://canary.cli.btp.int.sap/login/v2.49.0
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 153
+      uncompressed: false
+      body: '{"issuer":"identity.provider.test","refreshToken":"redacted","user":"john.doe@int.test","mail":"john.doe@int.test"}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "153"
+        Content-Type:
+          - application/json
+        Date:
+          - Fri, 20 Oct 2023 06:02:14 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - cf4924f7-0eab-44f9-44ac-9cab0e3bd2a9
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 278.6981ms
+  - id: 9
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 92
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"paramValues":{"origin":"sap.custom","subaccount":"ef23ace8-6ade-4d78-9c1f-8df729548bbf"}}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - e5313546-9473-6832-1b95-96de07a417a8
+        X-Cpcli-Customidp:
+          - identityProvider
+        X-Cpcli-Format:
+          - json
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Cpcli-Subdomain:
+          - terraformintcanary
+      url: https://canary.cli.btp.int.sap/command/v2.49.0/security/trust?get
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 0
+      uncompressed: false
+      body: ""
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "0"
+        Date:
+          - Fri, 20 Oct 2023 06:02:14 GMT
+        Expires:
+          - "0"
+        Location:
+          - https://cpcli.cf.eu12.hana.ondemand.com/command/v2.49.0/security/trust?get
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Subdomain:
+          - integration-test-acc-static-b8xxozer
+        X-Frame-Options:
+          - DENY
+        X-Id-Token:
+          - redacted
+        X-Vcap-Request-Id:
+          - 7a043900-bfa1-4c5a-4c0c-98eb714454c7
+        X-Xss-Protection:
+          - "0"
+      status: 307 Temporary Redirect
+      code: 307
+      duration: 108.5759ms
+  - id: 10
+    request:
+      proto: ""
+      proto_major: 0
+      proto_minor: 0
+      content_length: 92
+      transfer_encoding: []
+      trailer: {}
+      host: ""
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"paramValues":{"origin":"sap.custom","subaccount":"ef23ace8-6ade-4d78-9c1f-8df729548bbf"}}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        Referer:
+          - https://canary.cli.btp.int.sap/command/v2.49.0/security/trust?get
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - e5313546-9473-6832-1b95-96de07a417a8
+        X-Cpcli-Customidp:
+          - identityProvider
+        X-Cpcli-Format:
+          - json
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Cpcli-Subdomain:
+          - integration-test-acc-static-b8xxozer
+        X-Id-Token:
+          - redacted
+      url: https://cpcli.cf.eu12.hana.ondemand.com/command/v2.49.0/security/trust?get
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: -1
+      uncompressed: true
+      body: '{"name":"Custom IAS tenant","originKey":"sap.custom","typeOfTrust":"Application","status":"active","description":"IAS tenant terraformint.accounts400.ondemand.com (OpenID Connect)","identityProvider":"terraformint.accounts400.ondemand.com","domain":null,"linkTextForUserLogon":"terraformint.accounts400.ondemand.com","availableForUserLogon":"true","createShadowUsersDuringLogon":"true","sapBtpCli":"terraformint","protocol":"OpenID Connect","readOnly":false}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Type:
+          - application/json
+        Date:
+          - Fri, 20 Oct 2023 06:02:14 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Backend-Mediatype:
+          - application/json
+        X-Cpcli-Backend-Status:
+          - "200"
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - 7b83195b-8a70-429d-5be6-1b04150cec58
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 125.4146ms
+  - id: 11
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 118
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"customIdp":"identityProvider","subdomain":"terraformintcanary","userName":"john.doe@int.test","password":"testUserPassword"}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - cf3dc702-4a52-a0c3-9111-13685c19f241
+        X-Cpcli-Format:
+          - json
+      url: https://canary.cli.btp.int.sap/login/v2.49.0
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 153
+      uncompressed: false
+      body: '{"issuer":"identity.provider.test","refreshToken":"redacted","user":"john.doe@int.test","mail":"john.doe@int.test"}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "153"
+        Content-Type:
+          - application/json
+        Date:
+          - Fri, 20 Oct 2023 06:02:15 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - 8191e988-dc7d-4c09-772e-994815f2e8e4
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 319.914ms
+  - id: 12
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 118
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"customIdp":"identityProvider","subdomain":"terraformintcanary","userName":"john.doe@int.test","password":"testUserPassword"}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - e6424136-9fd6-203b-a8d1-b4ef191a3053
+        X-Cpcli-Format:
+          - json
+      url: https://canary.cli.btp.int.sap/login/v2.49.0
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 153
+      uncompressed: false
+      body: '{"issuer":"identity.provider.test","refreshToken":"redacted","user":"john.doe@int.test","mail":"john.doe@int.test"}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "153"
+        Content-Type:
+          - application/json
+        Date:
+          - Fri, 20 Oct 2023 06:02:15 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - dce664b2-bad2-4002-53d2-33a25020d993
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 296.1289ms
+  - id: 13
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 92
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"paramValues":{"origin":"sap.custom","subaccount":"ef23ace8-6ade-4d78-9c1f-8df729548bbf"}}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - f62903b5-5af2-efa0-cd9e-3b4b8b8802ce
+        X-Cpcli-Customidp:
+          - identityProvider
+        X-Cpcli-Format:
+          - json
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Cpcli-Subdomain:
+          - terraformintcanary
+      url: https://canary.cli.btp.int.sap/command/v2.49.0/security/trust?get
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 0
+      uncompressed: false
+      body: ""
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "0"
+        Date:
+          - Fri, 20 Oct 2023 06:02:15 GMT
+        Expires:
+          - "0"
+        Location:
+          - https://cpcli.cf.eu12.hana.ondemand.com/command/v2.49.0/security/trust?get
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Subdomain:
+          - integration-test-acc-static-b8xxozer
+        X-Frame-Options:
+          - DENY
+        X-Id-Token:
+          - redacted
+        X-Vcap-Request-Id:
+          - 96d9b969-ed9a-47cf-7538-a556b433e33e
+        X-Xss-Protection:
+          - "0"
+      status: 307 Temporary Redirect
+      code: 307
+      duration: 110.1649ms
+  - id: 14
+    request:
+      proto: ""
+      proto_major: 0
+      proto_minor: 0
+      content_length: 92
+      transfer_encoding: []
+      trailer: {}
+      host: ""
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"paramValues":{"origin":"sap.custom","subaccount":"ef23ace8-6ade-4d78-9c1f-8df729548bbf"}}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        Referer:
+          - https://canary.cli.btp.int.sap/command/v2.49.0/security/trust?get
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - f62903b5-5af2-efa0-cd9e-3b4b8b8802ce
+        X-Cpcli-Customidp:
+          - identityProvider
+        X-Cpcli-Format:
+          - json
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Cpcli-Subdomain:
+          - integration-test-acc-static-b8xxozer
+        X-Id-Token:
+          - redacted
+      url: https://cpcli.cf.eu12.hana.ondemand.com/command/v2.49.0/security/trust?get
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: [ ]
+      trailer: { }
+      content_length: -1
+      uncompressed: true
+      body: '{"error":"No entity found with values = [[03760ecf-9d89-4189-a92a-1c7efed09298, fuh, 03760ecf-9d89-4189-a92a-1c7efed09298]]"}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Type:
+          - application/json
+        Date:
+          - Wed, 18 Oct 2023 16:18:43 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Backend-Mediatype:
+          - application/json
+        X-Cpcli-Backend-Status:
+          - "404"
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - 46c7c47a-9be7-420a-78f4-bcade4cddfd4
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 125.002166ms
+  - id: 15
+    request:
+      proto: HTTP/1.1
+      proto_major: 1
+      proto_minor: 1
+      content_length: 118
+      transfer_encoding: []
+      trailer: {}
+      host: canary.cli.btp.int.sap
+      remote_addr: ""
+      request_uri: ""
+      body: |
+        {"customIdp":"identityProvider","subdomain":"terraformintcanary","userName":"john.doe@int.test","password":"testUserPassword"}
+      form: {}
+      headers:
+        Content-Type:
+          - application/json
+        User-Agent:
+          - Terraform/1.6.1 terraform-provider-btp/dev
+        X-Correlationid:
+          - 54cc55d2-817b-4749-ff97-db0b68dfe897
+        X-Cpcli-Format:
+          - json
+      url: https://canary.cli.btp.int.sap/login/v2.49.0
+      method: POST
+    response:
+      proto: HTTP/2.0
+      proto_major: 2
+      proto_minor: 0
+      transfer_encoding: []
+      trailer: {}
+      content_length: 153
+      uncompressed: false
+      body: '{"issuer":"identity.provider.test","refreshToken":"redacted","user":"john.doe@int.test","mail":"john.doe@int.test"}'
+      headers:
+        Cache-Control:
+          - no-cache, no-store, max-age=0, must-revalidate
+        Content-Length:
+          - "153"
+        Content-Type:
+          - application/json
+        Date:
+          - Fri, 20 Oct 2023 06:02:16 GMT
+        Expires:
+          - "0"
+        Pragma:
+          - no-cache
+        Referrer-Policy:
+          - no-referrer
+        Strict-Transport-Security:
+          - max-age=31536000; includeSubDomains; preload;
+        X-Content-Type-Options:
+          - nosniff
+        X-Cpcli-Sessionid:
+          - redacted
+        X-Frame-Options:
+          - DENY
+        X-Vcap-Request-Id:
+          - b9a9ecf5-09dd-4daa-6f8c-0177e26e73c3
+        X-Xss-Protection:
+          - "0"
+      status: 200 OK
+      code: 200
+      duration: 285.407ms
diff --git a/internal/provider/helper.go b/internal/provider/helper.go
new file mode 100644
index 0000000..a2e7c2d
--- /dev/null
+++ b/internal/provider/helper.go
@@ -0,0 +1,36 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/SAP/terraform-provider-btp/internal/btpcli"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+func stringNullIfEmpty(val string) types.String {
+	if len(val) == 0 {
+		return types.StringNull()
+	}
+	return types.StringValue(val)
+}
+
+func timeToValue(t time.Time) types.String {
+	if t.IsZero() {
+		return types.StringNull()
+	}
+
+	return types.StringValue(t.Format(time.RFC3339))
+}
+
+func handleReadErrors(ctx context.Context, rawRes btpcli.CommandResponse, resp *resource.ReadResponse, err error, resLogName string) {
+	// Treat HTTP 404 Not Found status as a signal to recreate resource
+	if rawRes.StatusCode == 404 {
+		resp.State.RemoveResource(ctx)
+	} else {
+		resp.Diagnostics.AddError(fmt.Sprintf("API Error Reading %s", resLogName), fmt.Sprintf("%s", err))
+	}
+
+}
diff --git a/internal/provider/helper_time.go b/internal/provider/helper_time.go
deleted file mode 100644
index 8ce4ed9..0000000
--- a/internal/provider/helper_time.go
+++ /dev/null
@@ -1,21 +0,0 @@
-package provider
-
-import (
-	"github.com/hashicorp/terraform-plugin-framework/types"
-	"time"
-)
-
-func stringNullIfEmpty(val string) types.String {
-	if len(val) == 0 {
-		return types.StringNull()
-	}
-	return types.StringValue(val)
-}
-
-func timeToValue(t time.Time) types.String {
-	if t.IsZero() {
-		return types.StringNull()
-	}
-
-	return types.StringValue(t.Format(time.RFC3339))
-}
diff --git a/internal/provider/resource_subaccount_trust_configuration.go b/internal/provider/resource_subaccount_trust_configuration.go
index 8ec323c..d0c8b69 100644
--- a/internal/provider/resource_subaccount_trust_configuration.go
+++ b/internal/provider/resource_subaccount_trust_configuration.go
@@ -172,9 +172,10 @@ func (rs *subaccountTrustConfigurationResource) Read(ctx context.Context, req re
 		return
 	}
 
-	cliRes, _, err := rs.cli.Security.Trust.GetBySubaccount(ctx, state.SubaccountId.ValueString(), state.Origin.ValueString())
+	cliRes, rawRes, err := rs.cli.Security.Trust.GetBySubaccount(ctx, state.SubaccountId.ValueString(), state.Origin.ValueString())
+
 	if err != nil {
-		resp.Diagnostics.AddError("API Error Reading Resource Trust Configuration (Subaccount)", fmt.Sprintf("%s", err))
+		handleReadErrors(ctx, rawRes, resp, err, "Resource Trust Configuration (Subaccount)")
 		return
 	}
 


Test patch:
diff --git a/internal/provider/resource_subaccount_trust_configuration_test.go b/internal/provider/resource_subaccount_trust_configuration_test.go
index 8161c25..7c3b98c 100644
--- a/internal/provider/resource_subaccount_trust_configuration_test.go
+++ b/internal/provider/resource_subaccount_trust_configuration_test.go
@@ -1,6 +1,7 @@
 package provider
 
 import (
+	"errors"
 	"fmt"
 	"regexp"
 	"testing"
@@ -124,6 +125,42 @@ func TestResourceSubaccountTrustConfiguration(t *testing.T) {
 		})
 	})
 
+	t.Run("happy path - plan recreate if resource doesn't exist anymore", func(t *testing.T) {
+		rec, user := setupVCR(t, "fixtures/resource_subaccount_trust_configuration.error_notfound")
+		defer stopQuietly(rec)
+
+		resource.Test(t, resource.TestCase{
+			IsUnitTest:               true,
+			ProtoV6ProviderFactories: getProviders(rec.GetDefaultClient()),
+			Steps: []resource.TestStep{
+				{
+					Config: hclProviderFor(user) + hclResourceSubaccountTrustConfigurationMinimal("uut", "ef23ace8-6ade-4d78-9c1f-8df729548bbf", "terraformint.accounts400.ondemand.com"),
+					Check: resource.ComposeAggregateTestCheckFunc(
+						resource.TestMatchResourceAttr("btp_subaccount_trust_configuration.uut", "subaccount_id", regexpValidUUID),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "identity_provider", "terraformint.accounts400.ondemand.com"),
+						resource.TestCheckNoResourceAttr("btp_subaccount_trust_configuration.uut", "domain"),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "name", "Custom IAS tenant"),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "description", "IAS tenant terraformint.accounts400.ondemand.com (OpenID Connect)"),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "link_text", "terraformint.accounts400.ondemand.com"),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "available_for_user_logon", "true"),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "auto_create_shadow_users", "true"),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "origin", "sap.custom"),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "id", "sap.custom"),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "type", "Application"),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "protocol", "OpenID Connect"),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "status", "active"),
+						resource.TestCheckResourceAttr("btp_subaccount_trust_configuration.uut", "read_only", "false"),
+					),
+				},
+				{
+					RefreshState:       true,
+					ExpectNonEmptyPlan: true,
+					Check:              verifyNoResourceState("btp_subaccount_trust_configuration.uut"),
+				},
+			},
+		})
+	})
+
 	t.Run("error path - import failure", func(t *testing.T) {
 		rec, user := setupVCR(t, "fixtures/resource_subaccount_trust_configuration.import_error")
 		defer stopQuietly(rec)
@@ -200,3 +237,13 @@ func getTrustConfigIdForImport(resourceName string) resource.ImportStateIdFunc {
 		return fmt.Sprintf("%s,%s", "ef23ace8-6ade-4d78-9c1f-8df729548bbf", rs.Primary.ID), nil
 	}
 }
+
+func verifyNoResourceState(resource string) resource.TestCheckFunc {
+	return func(state *terraform.State) error {
+		_, ok := state.RootModule().Resources[resource]
+		if ok {
+			return errors.New("expect State to be cleaned up")
+		}
+		return nil
+	}
+}