Upgrade terraform-provider-azurerm to v3.109.0 (#2143)

This PR was generated via `$ upgrade-provider pulumi/pulumi-azure
--kind=all --target-bridge-version=latest`.

Manual changes:
- Resolved patch conflicts in
`trafficmanager/traffic_manager_profile_resource.go` and
`loadbalancer/loadbalancer_resource.go`
- Added new module `azurePim = "Pim" // Privileged Identity Management`
- Added `azurerm_role_management_policy` and
`azurerm_email_communication_service_domain` resources
- Added `azurerm_role_management_policy` data source

---

- Upgrading terraform-provider-azurerm from 3.107.0  to 3.109.0.
	Fixes #2142
	Fixes #2130

patches/0010-Remove-vm-platform_fault_domain-required_with.patch

@@ -6,10 +6,10 @@ Subject: [PATCH] Remove vm platform_fault_domain required_with
 Applies to both Windows and Linux.
 
 diff --git a/internal/services/compute/linux_virtual_machine_resource.go b/internal/services/compute/linux_virtual_machine_resource.go
-index fdeed2c65d..b44f7e29d8 100644
+index 2a27490e54..86ef2beec9 100644
 --- a/internal/services/compute/linux_virtual_machine_resource.go
 +++ b/internal/services/compute/linux_virtual_machine_resource.go
-@@ -372,7 +372,6 @@ func resourceLinuxVirtualMachine() *pluginsdk.Resource {
+@@ -371,7 +371,6 @@ func resourceLinuxVirtualMachine() *pluginsdk.Resource {
  				Optional:     true,
  				Default:      -1,
  				ForceNew:     true,
@@ -18,10 +18,10 @@ index fdeed2c65d..b44f7e29d8 100644
  			},
 
 diff --git a/internal/services/compute/windows_virtual_machine_resource.go b/internal/services/compute/windows_virtual_machine_resource.go
-index 4c6030c160..e89e0f6de2 100644
+index 0226497579..94cf07503c 100644
 --- a/internal/services/compute/windows_virtual_machine_resource.go
 +++ b/internal/services/compute/windows_virtual_machine_resource.go
-@@ -387,7 +387,6 @@ func resourceWindowsVirtualMachine() *pluginsdk.Resource {
+@@ -386,7 +386,6 @@ func resourceWindowsVirtualMachine() *pluginsdk.Resource {
  				Optional:     true,
  				Default:      -1,
  				ForceNew:     true,

patches/0014-Update-documentation.patch

@@ -249,7 +249,7 @@ index a6e28af30a..d1804e780b 100644
 
  The deprecated field `start_task.environment` will be removed in favour of the `start_task.common_environment_properties` properties.
 diff --git a/website/docs/r/api_management.html.markdown b/website/docs/r/api_management.html.markdown
-index 0a17990cdc..83a563279f 100644
+index 3028d8fdb7..ad73383d68 100644
 --- a/website/docs/r/api_management.html.markdown
 +++ b/website/docs/r/api_management.html.markdown
 @@ -31,7 +31,7 @@ resource "azurerm_api_management" "example" {
@@ -638,10 +638,10 @@ index e9013a8f1a..f3f07aa79a 100644
  To find the Analytics Item ID you can query the REST API using the [`az rest` CLI command](https://docs.microsoft.com/cli/azure/reference-index?view=azure-cli-latest#az-rest), e.g.
 
 diff --git a/website/docs/r/automation_job_schedule.html.markdown b/website/docs/r/automation_job_schedule.html.markdown
-index db8146c418..5ede0b01b2 100644
+index cf1fbfa577..42f3ef7f89 100644
 --- a/website/docs/r/automation_job_schedule.html.markdown
 +++ b/website/docs/r/automation_job_schedule.html.markdown
-@@ -12,7 +12,7 @@ Links an Automation Runbook and Schedule.
+@@ -14,7 +14,7 @@ Links an Automation Runbook and Schedule.
 
  ## Example Usage
 
@@ -1140,10 +1140,10 @@ index b10dc1693a..bfc5dfcfd7 100644
  ---
 
 diff --git a/website/docs/r/cosmosdb_sql_container.html.markdown b/website/docs/r/cosmosdb_sql_container.html.markdown
-index d1745321f5..8cf56b2a69 100644
+index be6866ba9d..42950fef06 100644
 --- a/website/docs/r/cosmosdb_sql_container.html.markdown
 +++ b/website/docs/r/cosmosdb_sql_container.html.markdown
-@@ -73,11 +73,11 @@ The following arguments are supported:
+@@ -75,11 +75,11 @@ The following arguments are supported:
 
  * `unique_key` - (Optional) One or more `unique_key` blocks as defined below. Changing this forces a new resource to be created.
 
@@ -1794,7 +1794,7 @@ index c6387f8e37..ab11365777 100644
 
  ```hcl
 diff --git a/website/docs/r/kubernetes_cluster.html.markdown b/website/docs/r/kubernetes_cluster.html.markdown
-index d61a413f62..5dea5933b9 100644
+index 521522ff20..39c9ea274b 100644
 --- a/website/docs/r/kubernetes_cluster.html.markdown
 +++ b/website/docs/r/kubernetes_cluster.html.markdown
 @@ -10,15 +10,9 @@ description: |-

provider/go.mod

@@ -6,7 +6,7 @@ toolchain go1.21.3
 
 require (
 	github.com/Azure/go-autorest/autorest/azure/cli v0.4.6
-	github.com/hashicorp/go-azure-sdk/sdk v0.20240604.1114748
+	github.com/hashicorp/go-azure-sdk/sdk v0.20240610.1112704
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.33.0
 	github.com/hashicorp/terraform-provider-azurerm v1.44.1-0.20220923005104-eaa801c358ff
 	github.com/pulumi/providertest v0.0.11
@@ -123,7 +123,7 @@ require (
 	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-azure-helpers v0.69.0 // indirect
-	github.com/hashicorp/go-azure-sdk/resource-manager v0.20240604.1114748 // indirect
+	github.com/hashicorp/go-azure-sdk/resource-manager v0.20240610.1112704 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 // indirect

provider/go.sum

@@ -1633,10 +1633,10 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-azure-helpers v0.69.0 h1:JwUWXyDgyr6OafU4CgSvrbEP1wcMjfz4gxRQciDQkBQ=
 github.com/hashicorp/go-azure-helpers v0.69.0/go.mod h1:BmbF4JDYXK5sEmFeU5hcn8Br21uElcqLfdQxjatwQKw=
-github.com/hashicorp/go-azure-sdk/resource-manager v0.20240604.1114748 h1:sJEw1sYmLpBFUY+4UpE88GimbuAcvmo4ZvTPYenEdp4=
-github.com/hashicorp/go-azure-sdk/resource-manager v0.20240604.1114748/go.mod h1:1kTyma4K4ZtSWbtCNQfv8H2NZMsIyF+6S8GRbchmUCI=
-github.com/hashicorp/go-azure-sdk/sdk v0.20240604.1114748 h1:DJi4uLd/aUmAcXbTuQXeI6HukIG2ydrnq9aDM2o6D5A=
-github.com/hashicorp/go-azure-sdk/sdk v0.20240604.1114748/go.mod h1:Ts5vRL3KPw8iLit+4WSi1hOWlRCx++wJrCkMGj69xBY=
+github.com/hashicorp/go-azure-sdk/resource-manager v0.20240610.1112704 h1:APaOXyzHnmXF8SSVck0XJxFe+Y7OUHlGPt3dJ4YnU48=
+github.com/hashicorp/go-azure-sdk/resource-manager v0.20240610.1112704/go.mod h1:iRfW3HSkKTYgoqUg9oOOvd3dRDwzNUUbvtLjWUwrWT0=
+github.com/hashicorp/go-azure-sdk/sdk v0.20240610.1112704 h1:UDcE9AU+O5sAJobSdjAW0a0K87tiEEtAs3o9axJtpGQ=
+github.com/hashicorp/go-azure-sdk/sdk v0.20240610.1112704/go.mod h1:Ts5vRL3KPw8iLit+4WSi1hOWlRCx++wJrCkMGj69xBY=
 github.com/hashicorp/go-checkpoint v0.5.0 h1:MFYpPZCnQqQTE18jFwSII6eUQrD/oxMFp3mlgcqk5mU=
 github.com/hashicorp/go-checkpoint v0.5.0/go.mod h1:7nfLNL10NsxqO4iWuW6tWW0HjZuDrwkBuEQsVcpCOgg=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=

provider/resources.go

@@ -150,7 +150,8 @@ const (
 	azureOperationalInsights   = "OperationalInsights"   // Operational Insights
 	azureOrbital               = "Orbital"               // Orbital
 	azurePaloAlto              = "PaloAlto"              // PaloAlto
-	azurePostgresql            = "PostgreSql"            // Postgress SQL
+	azurePim                   = "Pim"                   // Privileged Identity Management
+	azurePostgresql            = "PostgreSql"            // Postgres SQL
 	azurePolicy                = "Policy"                // Policy
 	azurePortal                = "Portal"                // Portal
 	azurePowerBi               = "PowerBI"               // PowerBI
@@ -1707,6 +1708,8 @@ func Provider() tfbridge.ProviderInfo {
 			"azurerm_private_dns_resolver_outbound_endpoint":      {Tok: azureResource(azurePrivateDNS, "ResolverOutboundEndpoint")},
 			"azurerm_private_dns_resolver_virtual_network_link":   {Tok: azureResource(azurePrivateDNS, "ResolverVirtualNetworkLink")},
 
+			"azurerm_role_management_policy": {Tok: azureResource(azurePim, "RoleManagementPolicy")},
+
 			// SQL
 			"azurerm_sql_elasticpool":    {Tok: azureResource(azureSQL, "ElasticPool")},
 			"azurerm_sql_database":       {Tok: azureResource(azureSQL, "Database")},
@@ -2577,8 +2580,9 @@ func Provider() tfbridge.ProviderInfo {
 			},
 
 			// communication
-			"azurerm_communication_service":       {Tok: azureResource(azureCommunication, "Service")},
-			"azurerm_email_communication_service": {Tok: azureResource(azureCommunication, "EmailService")},
+			"azurerm_communication_service":              {Tok: azureResource(azureCommunication, "Service")},
+			"azurerm_email_communication_service":        {Tok: azureResource(azureCommunication, "EmailService")},
+			"azurerm_email_communication_service_domain": {Tok: azureResource(azureCommunication, "EmailServiceDomain")},
 
 			// confidential ledger
 			"azurerm_confidential_ledger": {Tok: azureResource(azureConfidentialLedger, "Ledger")},
@@ -3095,6 +3099,8 @@ func Provider() tfbridge.ProviderInfo {
 			// TODO: This resource is in the "Portal" module in the upstream provider. Move to a new namespace when terraform-provider-azurerm hits v3.0.
 			"azurerm_portal_dashboard": {Tok: azureDataSource(azureDashboard, "azurerm_portal_dashboard")},
 
+			"azurerm_role_management_policy": {Tok: azureDataSource(azurePim, "getRoleManagementPolicy")},
+
 			// Site Recovery
 			"azurerm_site_recovery_fabric":                    {Tok: azureDataSource(azureSiteRecovery, "getFabric")},
 			"azurerm_site_recovery_protection_container":      {Tok: azureDataSource(azureSiteRecovery, "getProtectionContainer")},

scripts/upstream.sh

@@ -2,6 +2,8 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 set -e
+set -o pipefail
+set -x
 
 # "$1" is the current make command being run.
 # It is used to make the error message more actionable.
@@ -91,7 +93,7 @@ start_rebase() {
 
   for patch in ../patches/*.patch; do
     echo "Applying $patch"
-    if ! git am --3way "$patch" --allow-empty; then
+    if ! git am --3way "$patch"; then
       echo
       echo "Failed to apply ${patch}. Please run 'make upstream.rebase FROM=$TAG' where '$TAG' allows the patch set to apply cleanly"
       echo