apigee: treat 403 as not-found in google_apigee_organization and google_apigee_envgroup reads

mmv1/products/apigee/Envgroup.yaml

@@ -40,6 +40,7 @@
     base_url: '{{op_id}}'
   result:
     resource_inside_response: true
+read_error_transform: 'transformApigeeNotFoundError'
 custom_code:
   custom_import: 'templates/terraform/custom_import/apigee_environment_group.go.tmpl'
 exclude_sweeper: true
@@ -48,7 +49,7 @@
     vars:
       envgroup_name: 'my-envgroup'
     exclude_test: true
       # This is a more verbose version of the above that creates all
       # the resources needed for the acceptance test.
   - name: 'apigee_environment_group_basic_test'
     primary_resource_id: 'apigee_environment_group'
@@ -56,7 +57,7 @@
       org_id: 'ORG_ID'
       billing_account: 'BILLING_ACCT'
     exclude_docs: true
       # Resource creation race
     skip_vcr: true
     external_providers: ["time"]
 parameters:

mmv1/products/apigee/Organization.yaml

@@ -44,6 +44,7 @@ async:
     resource_inside_response: true
 sweeper:
   identifier_field: "organization"
+read_error_transform: 'transformApigeeNotFoundError'
 custom_code:
   encoder: 'templates/terraform/encoders/apigee_organization.go.tmpl'
   custom_import: 'templates/terraform/custom_import/apigee_organization.go.tmpl'

mmv1/third_party/terraform/services/apigee/apigee_utils.go

@@ -3,6 +3,9 @@ package apigee
 import (
 	"encoding/json"
 	"fmt"
+	"strings"
+
+	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-google/google/tpgresource"
 	transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
@@ -13,6 +16,24 @@ import (
 	"time"
 )
 
+// transformApigeeNotFoundError converts a 403 that Apigee returns when a
+// resource does not exist (instead of 404) into a 404 error, so that
+// HandleNotFoundError can correctly remove the resource from state.
+//
+// Apigee deliberately returns 403 to avoid leaking information about whether a
+// resource exists, but for Terraform reads we must treat "may not exist" as
+// "not found".
+func transformApigeeNotFoundError(err error) error {
+	if gErr, ok := errwrap.GetType(err, &googleapi.Error{}).(*googleapi.Error); ok {
+		if gErr.Code == 403 && strings.Contains(gErr.Message, "or it may not exist") {
+			log.Printf("[DEBUG] Treating Apigee 403 as 404 (resource may not exist)")
+			gErr.Code = 404
+		}
+		return gErr
+	}
+	return err
+}
+
 func resourceApigeeNatAddressActivate(config *transport_tpg.Config, d *schema.ResourceData, billingProject string, userAgent string) error {
 	// 1. check prepare for activation
 	name := d.Get("name").(string)