disable data safe command not working

command line: oci data-safe service enable --is-enabled false --debug

when running the cli above, the command failed with reply 404. Also said our tenant id is unknown resource. debug message as below.

user id has full permission to all resource in tenant with policy statements as below:

allow group terraform-admin-group to manage all-resources in tenancy
allow group terraform-admin-group to manage data-safe-family in tenancy (the first policy should already cover this, but was added later for testing with the same failure)

...
reply: 'HTTP/1.1 404 Not Found\r\n'
...
oci.exceptions.ServiceError: {'target_service': 'data_safe', 'status': 404, 'code': 'NotAuthorizedOrNotFound', 'opc-request-id': 'CDD5A5F2766B44F8B4A64F991300F4D3/44047B8058C09369E9B9545B6A5E7CDB/54AC9B88F6DF7A956C55736E7E293958', 'message': 'Unknown resource ', 'operation_name': 'enable_data_safe_configuration', 'timestamp': '2023-04-21T13:16:38.117171+00:00', 'client_version': 'Oracle-PythonSDK/2.93.0', 'request_endpoint': 'PUT https://datasafe.ca-toronto-1.oci.oraclecloud.com/20181201/configuration', 'logging_tips': 'To get more info on the failing request, refer to https://docs.oracle.com/en-us/iaas/tools/python/latest/logging.html for ways to log the request/response details.', 'troubleshooting_tips': "See https://docs.oracle.com/iaas/Content/API/References/apierrors.htm#apierrors_404__404_notauthorizedornotfound for more information about resolving this error. Also see https://docs.oracle.com/iaas/api/#/en/data-safe/20181201/DataSafeConfiguration/EnableDataSafeConfiguration for details on this operation's requirements. If you are unable to resolve this data_safe issue, please contact Oracle support and provide them this full error message."}

Reproduce oci data-safe service enable --is-enabled false --debug and inspect the enable_data_safe_configuration request to the Data Safe endpoint in the debug output. Review the linked EnableDataSafeConfiguration requirements and the reported 404 response, then determine whether the CLI request or service-side resource handling is responsible. Done means the command works for a valid tenant or the issue is narrowed to an actionable CLI change.