fix hashicorp#28101

internal/services/apimanagement/api_management_product_resource.go

@@ -132,12 +132,32 @@ func resourceApiManagementProductCreateUpdate(d *pluginsdk.ResourceData, meta in
 
 	// Swagger says: Can be present only if subscriptionRequired property is present and has a value of false.
 	// API/Portal says: Cannot provide values for approvalRequired and subscriptionsLimit when subscriptionRequired is set to false in the request payload
-	if subscriptionRequired && subscriptionsLimit > 0 {
-		properties.Properties.ApprovalRequired = pointer.To(approvalRequired)
-		properties.Properties.SubscriptionsLimit = pointer.To(int64(subscriptionsLimit))
+	if subscriptionRequired {
+		if approvalRequired && subscriptionsLimit <= 0 {
+			return fmt.Errorf("`subscriptions_limit` must be greater than 0 to use `approval_required`")
+		}
+		// Set `subscriptions_limit` to null or omit to allow unlimited per user subscriptions
+		// When `subscriptions_limit` is specified as `0` it means the maximum number of subscriptions is 0, rather than allowing unlimited per user subscriptions
+		if !pluginsdk.IsExplicitlyNullInConfig(d, "subscriptions_limit") && subscriptionsLimit >= 0 {
+			properties.Properties.ApprovalRequired = pointer.To(approvalRequired)
+			properties.Properties.SubscriptionsLimit = pointer.To(int64(subscriptionsLimit))
+		}
 	} else if approvalRequired {
-		return fmt.Errorf("`subscription_required` must be true and `subscriptions_limit` must be greater than 0 to use `approval_required`")
+		return fmt.Errorf("`subscription_required` must be true to use `approval_required`")
+	}
+
+	if !pluginsdk.IsExplicitlyNullInConfig(d, "subscriptions_limit") {
+		if subscriptionRequired && subscriptionsLimit >= 0 {
+			properties.Properties.SubscriptionsLimit = pointer.To(int64(subscriptionsLimit))
+		}
+
+		if approvalRequired && subscriptionsLimit > 0 {
+			properties.Properties.ApprovalRequired = pointer.To(approvalRequired)
+		}
 	}
+	//} else if approvalRequired && subscriptionsLimit == 0 {
+	//	return fmt.Errorf("`subscription_required` must be true to use `approval_required`")
+	//}
 
 	if _, err := client.CreateOrUpdate(ctx, id, properties, product.CreateOrUpdateOperationOptions{}); err != nil {
 		return fmt.Errorf("creating/updating %s: %+v", id, err)

internal/services/apimanagement/api_management_product_resource_test.go

@@ -119,6 +119,16 @@ func TestAccApiManagementProduct_subscriptionsLimit(t *testing.T) {
 			),
 		},
 		data.ImportStep(),
+		{
+			Config: r.subscriptionLimitsUpdate(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("approval_required").HasValue("false"),
+				check.That(data.ResourceName).Key("subscription_required").HasValue("true"),
+				check.That(data.ResourceName).Key("subscriptions_limit").HasValue("0"),
+			),
+		},
+		data.ImportStep(),
 	})
 }
 
@@ -310,6 +320,40 @@ resource "azurerm_api_management_product" "test" {
 `, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
 }
 
+func (ApiManagementProductResource) subscriptionLimitsUpdate(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+resource "azurerm_resource_group" "test" {
+  name     = "acctestRG-%d"
+  location = "%s"
+}
+
+resource "azurerm_api_management" "test" {
+  name                = "acctestAM-%d"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+  publisher_name      = "pub1"
+  publisher_email     = "[email protected]"
+
+  sku_name = "Consumption_0"
+}
+
+resource "azurerm_api_management_product" "test" {
+  product_id            = "test-product"
+  api_management_name   = azurerm_api_management.test.name
+  resource_group_name   = azurerm_resource_group.test.name
+  display_name          = "Test Product"
+  subscription_required = true
+  approval_required     = false
+  subscriptions_limit   = 0
+  published             = false
+}
+`, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
+}
+
 func (ApiManagementProductResource) complete(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 provider "azurerm" {