code: func (cl *Client) ModifyIAMPolicy(c context.Context, resource string, cb func(*Policy) error) error {
  	policy, err := cl.GetIAMPolicy(c, resource)
  	if err != nil {
  		return err
  	}
  	// Make a copy to be mutated in the callback. Need to keep the original to
  	// be able to detect changes.
  	clone := policy.Clone()
  	if err := cb(&clone); err != nil {
  		return err
  	}
  	if clone.Equals(*policy) {
  		return nil
  	}
  	_, err = cl.SetIAMPolicy(c, resource, clone)
  	return err
  }
docs: // ModifyIAMPolicy reads IAM policy, calls callback to modify it, and then
  // puts it back (if callback really changed it).
  //
  // Cast error to *googleapi.Error and compare http status to http.StatusConflict
  // to detect update race conditions. It is usually safe to retry in case of
  // a conflict.