How to delete iam polices when the whole deployment is deleted?

Hi,

I followed [this example](https://github.com/likeulb/deploymentmanager-samples/blob/master/examples/v2/project_creation/project.py#L121) to successfully bind service accounts with roles. I'm wondering what the right way is to delete these bindings when the whole deployment is deleted. I couldn't find any example for that in this repo.

My failed attempt was the following, which i defined a resource `delete-iam-policy` that would delete the bindings during the deployment deletion.

`sa.jinja:`
```yaml
{% set ID = env['deployment'] %}
{% set service_accounts = [
{
'name': 'sa1',
'roles': [
'roles/cloudsql.client'
]
},
{
'name': 'sa2',
'roles': [
'roles/bigtable.admin',
'roles/pubsub.subscriber',
'roles/cloudsql.admin'
]
},
{
'name': 'sa3',
'roles': [
'roles/bigtable.admin',
'roles/pubsub.publisher',
'roles/cloudsql.admin'
]
}
]
%}

resources:
{% for sa in service_accounts %}
- name: {{ ID }}-{{ sa.name }}-sa
type: iam.v1.serviceAccount
properties:
accountId: {{ ID }}-{{ sa.name }}-sa
displayName: service account for {{ sa.name }} access
{% endfor %}

- name: get-iam-policy
action: gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.getIamPolicy
properties:
resource: {{ env['project'] }}
metadata:
runtimePolicy:
- 'UPDATE_ALWAYS'

- name: patch-iam-policy
action: gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy
properties:
resource: {{ env['project'] }}
policy: $(ref.get-iam-policy)
gcpIamPolicyPatch:
add:
{% for sa in service_accounts %}
{% for role in sa.roles %}
- role: {{ role }}
members:
- serviceAccount:$(ref.{{ ID }}-{{ sa.name }}-sa.email)
{% endfor %}
{% endfor %}

- name: delete-iam-policy
action: gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy
metadata:
runtimePolicy:
- DELETE
properties:
resource: {{ env['project'] }}
policy: $(ref.get-iam-policy)
gcpIamPolicyPatch:
remove:
{% for sa in service_accounts %}
{% for role in sa.roles %}
- role: {{ role }}
members:
- serviceAccount:$(ref.{{ ID }}-{{ sa.name }}-sa.email)
{% endfor %}
{% endfor %}
metadata:
dependsOn:
- patch-iam-policy
```

However, I got the following error:

```bash
$ gcloud deployment-manager deployments create --template=sa.jinja test
ERROR: (gcloud.deployment-manager.deployments.update) Error in Operation [operation-1539610184254-578446e200231-f87ae5fd-0498049a]: errors:
- code: RESOURCE_ERROR
location: /deployments/test/resources/delete-iam-policy
message: '{"ResourceType":"gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy","ResourceErrorCode":"409","ResourceErrorMessage":{"code":409,"message":"There
were concurrent policy changes. Please retry the whole read-modify-write with
exponential backoff.","status":"ABORTED","statusMessage":"Conflict","requestPath":"https://cloudresourcemanager.googleapis.com/v1/projects/teamy-mcteamface:setIamPolicy","httpMethod":"POST"}}'
```

I'm not sure why there were concurrent policy changes. I've set `delete-iam-policy` depend on `patch-iam-policy`, so i expect they are created sequentially. How can i fix that?