[ISSUE] The databricks_group resource shouldn't allow you to specify system groups

[Xophmeister]

Configuration

In v0.4.7 of the provider, the databricks_group resource has the force argument. This allows you to do, for example:

resource "databricks_group" "system" {
  for_each = toset(["admins", "user"])

  display_name = each.value
  force        = true
}

Expected Behavior

The provider should forbid this.

Actual Behavior

This works fine and it will even reflect new argument values to the group (e.g., allow_cluster_create, etc.). The problem comes when you try to destroy this resource: The Databricks API forbids this and so terraform destroy will fail.

Steps to Reproduce

1. terraform apply
2. terraform destroy

Terraform and provider versions

Terraform v1.0.11
on linux_amd64
+ provider registry.terraform.io/databrickslabs/databricks v0.4.7

[nfx]

why do you want to use force with admins and users?...

[Xophmeister]

I was trying to creating a mapping from external users to Databricks which allowed arbitrary input. In my testing -- not knowing that admins and users were special -- I hit this problem. I refactored my module such that users is avoided altogether (see #1088) and the ID for admins is fetched from a data source. So the mistake was mine, but it could have been avoided if invalid state was unrepresentable.

[nfx]

@Xophmeister #1088 won't fix. though #1091 should fix this issue.