secretmanager: add IAM helper

Fixes https://github.com/googleapis/google-cloud-go/issues/1882

Copied the two IAM files from apiv1beta1.

Change-Id: I1505d8a1f394258f3f69c20ee1a6045b5253fb50
Reviewed-on: https://code-review.googlesource.com/c/gocloud/+/53710
Reviewed-by: Seth Vargo <sethvargo@google.com>
Reviewed-by: Cody Oss <codyoss@google.com>
Reviewed-by: kokoro <noreply+kokoro@google.com>
diff --git a/secretmanager/apiv1/iam.go b/secretmanager/apiv1/iam.go
new file mode 100644
index 0000000..e3d78a5
--- /dev/null
+++ b/secretmanager/apiv1/iam.go
@@ -0,0 +1,26 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package secretmanager
+
+import (
+	"cloud.google.com/go/iam"
+)
+
+// IAM returns a handle to inspect and change permissions of the resource
+// indicated by the given resource path. Name should be of the format
+// `projects/my-project/secrets/my-secret`.
+func (c *Client) IAM(name string) *iam.Handle {
+	return iam.InternalNewHandleGRPCClient(c.client, name)
+}
diff --git a/secretmanager/apiv1/iam_example_test.go b/secretmanager/apiv1/iam_example_test.go
new file mode 100644
index 0000000..7fc78f2
--- /dev/null
+++ b/secretmanager/apiv1/iam_example_test.go
@@ -0,0 +1,40 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package secretmanager_test
+
+import (
+	"context"
+
+	secretmanager "cloud.google.com/go/secretmanager/apiv1"
+)
+
+func ExampleClient_IAM() {
+	ctx := context.Background()
+	c, err := secretmanager.NewClient(ctx)
+	if err != nil {
+		// TODO: Handle error.
+	}
+
+	// TODO: fill in secret resource path
+	secret := "projects/[PROJECT_ID]/secrets/[SECRET]"
+	handle := c.IAM(secret)
+
+	policy, err := handle.Policy(ctx)
+	if err != nil {
+		// TODO: Handle error.
+	}
+	// TODO: Use policy.
+	_ = policy
+}