If a role is removed from (or added to) a group outside of terraform, the provider does not detect this change. Steps to reproduce: 1. Create group with some attached roles using terraform 2. Remove a role outside of terraform, e.g. using the GUI 3. Apply terraform again without changing the configuration. The change will not be detected and the state does no longer reflect the reality.