fix: empty tags drift on fwprovider resources

.changelog/38636.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+provider: Fix empty tags drift on fwprovider resources
+```

internal/provider/fwprovider/intercept.go

@@ -516,7 +516,8 @@ func (r tagsResourceInterceptor) read(ctx context.Context, request resource.Read
 		apiTags := tagsInContext.TagsOut.UnwrapOrDefault()
 
 		// AWS APIs often return empty lists of tags when none have been configured.
-		stateTags := tftags.Null
+		var stateTags fwtypes.Map
+		response.State.GetAttribute(ctx, path.Root(names.AttrTags), &stateTags)
 		// Remove any provider configured ignore_tags and system tags from those returned from the service API.
 		// The resource's configured tags do not include any provider configured default_tags.
 		if v := apiTags.IgnoreSystem(inContext.ServicePackageName).IgnoreConfig(tagsInContext.IgnoreConfig).ResolveDuplicatesFramework(ctx, tagsInContext.DefaultConfig, tagsInContext.IgnoreConfig, response, diags).Map(); len(v) > 0 {

internal/service/networkmonitor/monitor_test.go

@@ -65,6 +65,13 @@ func TestAccNetworkMonitorMonitor_tags(t *testing.T) {
 		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
 		CheckDestroy:             testAccCheckMonitorDestroy(ctx),
 		Steps: []resource.TestStep{
+			{
+				Config: testAccMonitorConfig_tags0(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckMonitorExists(ctx, resourceName),
+					resource.TestCheckResourceAttr(resourceName, acctest.CtTagsPercent, acctest.Ct0),
+				),
+			},
 			{
 				Config: testAccMonitorConfig_tags1(rName, acctest.CtKey1, acctest.CtValue1),
 				Check: resource.ComposeTestCheckFunc(
@@ -172,6 +179,17 @@ resource "aws_networkmonitor_monitor" "test" {
 `, rName, aggregation)
 }
 
+func testAccMonitorConfig_tags0(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_networkmonitor_monitor" "test" {
+  aggregation_period = 30
+  monitor_name       = %[1]q
+
+  tags = {}
+}
+`, rName)
+}
+
 func testAccMonitorConfig_tags1(rName, tagKey1, tagValue1 string) string {
 	return fmt.Sprintf(`
 resource "aws_networkmonitor_monitor" "test" {