Don't lock policy if it is already locked. (#1307)

Signed-off-by: Modular Magician <magic-modules@google.com>

google-beta/resource_storage_bucket.go

@@ -392,7 +392,9 @@ func resourceStorageBucketCreate(d *schema.ResourceData, meta interface{}) error
 	log.Printf("[DEBUG] Created bucket %v at location %v\n\n", res.Name, res.SelfLink)
 	d.SetId(res.Id)
 
-	if v, ok := d.GetOk("retention_policy"); ok {
+	// If the retention policy is not already locked, check if it
+	// needs to be locked.
+	if v, ok := d.GetOk("retention_policy"); ok && !res.RetentionPolicy.IsLocked {
 		retention_policies := v.([]interface{})
 
 		sb.RetentionPolicy = &storage.BucketRetentionPolicy{}
@@ -514,7 +516,7 @@ func resourceStorageBucketUpdate(d *schema.ResourceData, meta interface{}) error
 
 			retentionPolicy := retention_policies[0].(map[string]interface{})
 
-			if locked, ok := retentionPolicy["is_locked"]; ok && locked.(bool) {
+			if locked, ok := retentionPolicy["is_locked"]; ok && locked.(bool) && d.HasChange("retention_policy.0.is_locked") {
 				err = lockRetentionPolicy(config.clientStorage.Buckets, d.Get("name").(string), res.Metageneration)
 				if err != nil {
 					return err