Optimistic Concurrency Control (OCC) is a strategy used to prevent "lost updates" or race conditions when multiple processes attempt to modify the same IAM policy simultaneously.
In Google Cloud IAM, every policy object contains an etag (entity tag). The OCC mechanism works as follows:
- Read: When you fetch a policy, the server returns an
etag. - Write: When you send a modified policy back to the server, you must include that original
etag. - Validation: The server compares the provided
etag with the current stored etag. If they do not match (meaning someone else modified the policy in the meantime), the write fails.
When a write fails due to an etag mismatch, the client must catch the error and retry the entire cycle: re-read the new policy, re-apply changes, and attempt to write again.