Change ServicePerimeterResource to use a policy level mutex lock

[coder-221]

This is a prerequisite for an upcoming PR for adding etags to ServicePerimeterResource.

Why change the mutex lock?

Multiple service perimeters can exist within the same policy and the policy is really the core entity. So, etags are logically at the policy level and this means all perimeters within the same policy will have the same etag. Without this change, if two update requests with etags were sent from Terraform to change different perimeters in the same policy around the same time (a few seconds) the second request would be rejected. While it's queueing, the valid etag for the policy would change so the etag in its request body would no longer work. This change makes it so the second request would only start processing (and fetch a valid etag) after no other update requests for the entire policy are in progress.

What's the impact of this change?

• I'm not expecting a performance hit. Consider two cases:
  • If customers had multiple ServicePerimeterResource previously and they were all in the same perimeter, they would have been processed sequentially anyway since they would have the share a mutex lock on the same perimeter.
  • If customers had multiple ServicePerimeterResource previously and they were in different perimeters, then the API calls to update them would still be processed serially to ensure data integrity. Ie a second update request would queue until the first finished anyway. So, with this change we're just saying don't even try the requests yet since they'd be queued by the server anyway.

Terraform API changes

• Users cannot set the access_policy_id property. It may be visible in plan output but I doubt it will cause confusion. If there's a way to have a completely internal property, please let me know.

Testing

• I tested this locally and see the following ouput:

2025-01-10T00:17:01.159Z [DEBUG] provider.terraform-provider-google-test: 2025/01/10 00:17:01 [DEBUG] Unlocking "accessPolicies/2401018548552"
2025-01-10T00:17:01.159Z [DEBUG] provider.terraform-provider-google-test: 2025/01/10 00:17:01 [DEBUG] Unlocked "accessPolicies/2401018548552"

Warning

I'll also make similar changes to all other ACM resource types, but I thought it would be good to start with just this to ensure the pattern is fine. To reduce risk, I think we should change all of the mutex locks to policy in the same TF release so please hold off on merging this PR until the other PR is ready as well. Thanks!

Release Note Template for Downstream PRs (will be copied)

See Write release notes for guidance.

[coder-221]

Feel free to review, but please hold off on merging. I'll have an ACM team member review as well. Thanks!

[github-actions]

Hello! I am a robot. Tests will require approval from a repository maintainer to run.

@SirGitsalot, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 3 files changed, 127 insertions(+), 2 deletions(-))
google-beta provider: Diff ( 3 files changed, 127 insertions(+), 2 deletions(-))

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 3 files changed, 127 insertions(+), 2 deletions(-))
google-beta provider: Diff ( 3 files changed, 127 insertions(+), 2 deletions(-))

[modular-magician]

Tests analytics

Total tests: 3
Passed tests: 3
Skipped tests: 0
Affected tests: 0

Click here to see the affected service packages

• accesscontextmanager

🟢 All tests passed!

View the build log

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 3 files changed, 33 insertions(+), 2 deletions(-))
google-beta provider: Diff ( 3 files changed, 33 insertions(+), 2 deletions(-))

[modular-magician]

Tests analytics

Total tests: 3
Passed tests: 3
Skipped tests: 0
Affected tests: 0

Click here to see the affected service packages

• accesscontextmanager

🟢 All tests passed!

View the build log

[modular-magician]

Tests analytics

Total tests: 3
Passed tests: 3
Skipped tests: 0
Affected tests: 0

Click here to see the affected service packages

• accesscontextmanager

🟢 All tests passed!

View the build log