We have a VPC SC Perimeter enforced in the GCP env. When trying to create a PUB SUB Subscription in the project the Terraform apply is failing as

Error: Error creating Subscription: googleapi: Error 403: Request is prohibited by organization's policy

Subscription details,

Subscription created in ProjectA with Topic also in ProjectA.
It is a Push Subscription with an Push Endpoint being a Cloud Function which is also in ProjectA.

In Log Explorer, VPC SC Logs are not really direct but below is what coming when trying to create the subscription,

{
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "status": {
      "code": 7,
      "message": "Request is prohibited by organization's policy. vpcServiceControlsUniqueIdentifier: <id>",
      "details": [
        {
          "@type": "type.googleapis.com/google.rpc.PreconditionFailure",
          "violations": [
            {
              "type": "VPC_SERVICE_CONTROLS",
              "description": "<id>"
            }
          ]
        }
      ]
    },
    "authenticationInfo": {},
    "requestMetadata": {
      "callerIp": "<IP>"
    },
    "serviceName": "storage.googleapis.com",
    "methodName": "google.storage.buckets.testIamPermissions",
    "resourceName": "projects/<PROJ_NUMBER>",
    "metadata": {
      "vpcServiceControlsUniqueId": "<ID>",
      "violationReason": "NO_MATCHING_ACCESS_LEVEL",
      "ingressViolations": [
        {
          "servicePerimeter": "accessPolicies/<org_policy_id>/servicePerimeters/<perimeter_name>",
          "targetResource": "projects/<PROJ_NUMBER>"
        }
      ],
      "deviceState": "Unknown",
      "resourceNames": [
        "projects/_/buckets/eu.artifacts.<project_name>.appspot.com"
      ],
      "securityPolicyInfo": {
        "organizationId": "<org_id>",
        "servicePerimeterName": "accessPolicies/<org_policy_id>/servicePerimeters/<perimeter_name>"
      },
      "@type": "type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata"
    }
  },
  "insertId": "<id>",
  "resource": {
    "type": "audited_resource",
    "labels": {
      "method": "google.storage.buckets.testIamPermissions",
      "service": "storage.googleapis.com",
      "project_id": "<project_name>"
    }
  },
  "severity": "ERROR",
}

The logs doesn’t have any Authentication Info ( which can be added within Ingress Rules ) neither anything particular to get to the root cause.

Any resolution for this ?