OK, two things:
First is that I think the value of the tag is the important bit, not the key name. In my setup, the keys are actually named "CloudNGFWFirewallAdmin1" and "CloudNgfwRulestackAdmin". Try setting the values to the values mentioned in the 2nd link I provided and see if that changes the result.
Second, since you are essentially stuck at, "I'm trying to enable API access," this is fully supported TAC territory. If you have a support contract with Palo Alto Networks in place, then I'd encourage you to reach out to TAC for help. The Terraform provider is unreleased currently and should otherwise be considered beta code, but enabling API access has nothing to do with the provider.
... View more