title: How to create a google cloud pubsub pull subscriptions with service account by terraform?
body: <p>In the terraform documentation for <em>google_pubsub_subscription</em>, it mentions having a <em>oidc_token</em> property under <em>push_configuration</em> allows push-subscriptions to utilise service account, but has no mention on how to use service account for <strong>pull subscriptions</strong>.</p>
  <p>How can explicitly set the service account to be used during the creation of <strong>pull</strong> pubsub subscriptions?</p>
  <p>I tried adding <em>oidc_token</em> block, but it did not worked as it does not expect that block directly.</p>
  <p>Scenario:</p>
  <ol>
  <li>I have a service account that has access to pubsub topics (and necessary permissions to attach subscriptions to it) in <strong>Project_A</strong></li>
  <li>I want to create subscriptions to those topics in <strong>Project_B</strong> in terraform.</li>
  <li>I need to explicitly use this service account in terraform, so i can create subscriptions at <em>Project_B</em> to topics of <em>Project_A</em></li>
  </ol>
  <p><em>google_cloudfunctions_function</em> resource for example, has field called service_account_email for setting service account. But there is no for <em>google_pubsub_subscription</em> resource, <strong>for pull subscriptions</strong> in the <a href="https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/pubsub_subscription" rel="nofollow noreferrer">documentation</a>.</p>