[BUG] Error when re-creating subaccount due to read-only role

[EliasB17]

Is there an existing issue for this?

• I have searched the existing issues

What version of the Terraform exporter are you using?

1.4.0

What version of the Terraform CLI/OpenTofu CLI are you using?

1.13.3

What type of issue are you facing

bug report

Describe the bug

When exporting a subaccount using the Exporter in SAP Business Application Studio, the role "Application Frontend Developer" is included in the export by default.
If the subaccount is later deleted and re-created via the Terraform SAP BTP Provider, the re-creation process fails when trying to re-apply this role.

Error Messages:
API does not support the deletion of read-only Role
Role already exists

This issue occurs because the role is read-only and cannot be deleted or re-created via API, yet it is still included in the exported configuration.

Expected Behavior

The exporter should exclude read-only roles like "Application Frontend Developer" from the export.

Steps To Reproduce

1. Export a subaccount using the Exporter in SAP BAS.
2. Ensure the role "Application Frontend Developer" is part of the exported configuration.
3. Delete the original subaccount.
4. Re-create the subaccount using the exported configuration via Terraform.
5. Observe the error when Terraform attempts to re-create the read-only role.

User's Role Collections

Global Account Administrator
Subaccount Administrator

Add screenshots to help explain your problem

Additional context

I'm currently using a trial account.

[lechnerc77]

Needs to be checked if these roles can be indentified and consequently filtered out from the export

Manual workaround exists

[lechnerc77]

Cross checked Implementation: the logic to filter roles also requires an empty attribute list. This is not the case in this sample. Internal clarification needed.

[lechnerc77]

Current state from XSUUA team: A non-empty attributes list means that the role was customized and needs to be exported independent if it is read-only or not.
This configuration surfaces only for this role on trial and prod subaccounts, request to service owner is out

[lechnerc77]

Update: role must be filtered out exclusively - setup of role is non-standard but intentionally