使用Terraform配置GCP Pub/Sub推送订阅认证遇阻求助

• 正在配置3个GCP Pub/Sub推送订阅，基础订阅已成功部署，但无法启用推送订阅的认证功能。
• 已完成必要权限配置：为项目内Pub/Sub代理授予roles/iam.serviceAccountTokenCreator角色，调用所用的ServiceAccount已获得roles/iam.serviceAccountUser权限。
• 使用Terraform的GCP Pub Sub Module（v5.0.0版本）编排资源，但执行Terraform预计划时，看不到任何与认证相关的配置内容。

Terraform模块代码 #

module "app-pubsubpush" {
  source   = "terraform-google-modules/pubsub/google"
  version  = "~> 5.0"
  for_each = { for x, n in var.pubsubpush_config : x => n }

  project_id = var.project_id

  topic               = each.value.pubsub_topic_name
  topic_labels        = each.value.pubsub_topic_labels
  subscription_labels = each.value.subscription_labels

  push_subscriptions = [
    {
      name = each.value.pubsub_subscription_name
      push_endpoint              = each.value.pubsub_subscription_endpoint
      oidc_token                 = each.value.oidc_token
      message_retention_duration = "604800s" // Default (7 days)
      retain_acked_messages      = false     // Default
      ack_deadline_seconds       = 10        // Default
      expiration_policy          = ""        // Subscription never expires
      max_delivery_attempts = 5      // Default
      minimum_backoff       = "10s"  // Default
      maximum_backoff       = "600s" // Default

      enable_message_ordering      = true
      enable_exactly_once_delivery = true

      service_account = var.pubsub_subscription_sa
    }
  ]

  depends_on = [
    module.pubsub_dl
  ]
}

npd.tfvar 变量配置 #

pubsub_config = [
  {
    pubsub_topic_name = "app_notifications"
    pubsub_topic_labels = {
      cm_application_service_num = "snsvc0011392" # ArcSight-NPD-001
      cm_service_offering_num    = "bsn0010403"   # Security Monitoring & Alerting - ArcSight-NPD
    }
    subscription_labels = {
      cm_application_service_num = "snsvc0011392" # ArcSight-NPD-001
      cm_service_offering_num    = "bsn0010403"   # Security Monitoring & Alerting - ArcSight-NPD
    }
    pubsub_subscription_name     = "app_notifications_arcsight"
    pubsub_subscription_dl_topic = "app_notifications_arcsight_dl"
  }
]

#===========Pubsub Subscription Service Account===========#

pubsub_subscription_sa = "soc-logsink-npd@cnr-orgiam-prd-m4x6.iam.gserviceaccount.com"
pubsub_push_subscription_sa = "soc-logsink2arcsight-npd@cnr-scc-npd-kaw8.iam.gserviceaccount.com"

pubsubpush_config = [
    {
    pubsub_topic_name = "app_notifications_secops"
    pubsub_topic_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    subscription_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    pubsub_subscription_endpoint = "https://us-chronicle.googleapis.com/v1alpha/projects/xxxxxx/locations/us/instances/xxxxxx/feeds/xxxxxxxxx:importPushLogs"
    oidc_token                   =  "soc-logsink2arcsight-npd@cnr-scc-npd-kaw8.iam.gserviceaccount.com"
    pubsub_subscription_name     = "app_notifications_secops_push"
 #   pubsub_subscription_dl_topic = "app_notifications_secops_dl"
  },
    {
    pubsub_topic_name = "appengine_notifications_secops"
    pubsub_topic_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    subscription_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    pubsub_subscription_endpoint = "https://us-chronicle.googleapis.com/v1alpha/projects/xxxxxxx/locations/us/instances/xxxxxxxxx/feeds/xxxxxx-xxxxxx:importPushLogs"
    oidc_token                   = "soc-logsink2arcsight-npd@cnr-scc-npd-kaw8.iam.gserviceaccount.com",
    pubsub_subscription_name     = "appengine_notifications_secops_push"
  
  },
    {
    pubsub_topic_name = "dataaccess_notifications_secops"
    pubsub_topic_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    subscription_labels = {
      cm_application_service_num = "snsvc0031048"  
      cm_service_offering_num    = "bsn0011961"    
    }
    pubsub_subscription_endpoint = "https://us-chronicle.xxxxx/v1alpha/projects/xxxxxxx/locations/us/instances/xxxxxxxxxx/feeds/6ef5f8d4-8199-4cb7-8cb6-43d5331a0182:importPushLogs"
    oidc_token                   =  "soc-logsink2arcsight-npd@cnr-scc-npd-kaw8.iam.gserviceaccount.com"
    pubsub_subscription_name     = "dataaccess_notifications_secops_push"
   
  }
]

内容的提问来源于stack exchange，提问作者Pallab