anchor.diff:  	crypto_key = google_kms_crypto_key.project-2-key.id
   	plaintext  = "my-secret"
   }
  -`, testAccProviderIndirectUserProjectOverride_step3(pid, name, org, billing, sa, override), pid, pid)
  -}
  -
  -func testAccProviderIndirectUserProjectOverride_step3(pid, name, org, billing, sa string, override bool) string {
  +`, testAccProviderIndirectUserProjectOverride_step3(accessToken, override), pid, pid, pid)
  +}
  +
  +func testAccProviderIndirectUserProjectOverride_step3(accessToken string, override bool) string {
   	return fmt.Sprintf(`
  -%s
  -
  -data "google_service_account_access_token" "project-1-token" {
  -	// This data source would have a depends_on to
  -	// google_service_account_iam_binding.token-creator-iam, but depends_on
  -	// in data sources makes them always have a diff in apply:
  -	// https://www.terraform.io/docs/configuration/data-sources.html#data-resource-dependencies
  -	// Instead, rely on the other test step completing before this one.
  -
  -	target_service_account = google_service_account.project-1.email
  -	scopes                 = ["userinfo-email", "https://www.googleapis.com/auth/cloud-platform"]
  -	lifetime               = "300s"
  -}
  -
   provider "google" {
   	alias = "project-1-token"
   
  -	access_token          = data.google_service_account_access_token.project-1-token.access_token
  +	access_token          = "%s"
   	user_project_override = %v
   }
  -`, testAccProviderIndirectUserProjectOverride(pid, name, org, billing, sa), override)
  +`, accessToken, override)
   }
   
   // getTestRegion has the same logic as the provider's getRegion, to be used in tests.
  
positive.code: 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
  	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
  	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
  )
  
  var testAccProviders map[string]*schema.Provider
  
negative.code: // Set up two projects. Project 1 has a service account that is used to create a
  // pubsub topic in project 2. The pubsub API is only enabled in project 2,
  // which causes the create to fail unless user_project_override is set to true.
  
  func testAccProviderUserProjectOverride_step2(accessToken, pid string, override bool, topicName string) string {
  	return fmt.Sprintf(`
  // See step 3 below, which is really step 2 minus the pubsub topic.
  // Step 3 exists because provider configurations can't be removed while objects
  