01 The best practice is to use a dead-letter topic that is different than the Pub/Sub topic(s) you are subscribing to. Run pubsub topics create command (Windows/macOS/Linux) using the name of the GCP project that you want to access as identifier parameter, to create a new Pub/Sub dead-letter topic that will capture undeliverable messages:
gcloud pubsub topics create cc-dead-letter-topic
--project cc-dataflow-project-123123
02 The command output should return the full resource identifier of the newly created topic:
Created topic [projects/cc-dataflow-project-123123/topics/cc-dead-letter-topic].
03 The new dead-letter topic should have at least one subscription so that dead-lettered messages will not be lost. Run pubsub subscriptions create command (Windows/macOS/Linux) to create the required subscription for the newly created Pub/Sub dead-letter topic:
gcloud pubsub subscriptions create cc-dead-letter-subscription
--topic=cc-dead-letter-topic
--topic-project=cc-dataflow-project-123123
04 The command output should return the resource ID of the new Pub/Sub subscription:
Created subscription [projects/cc-dataflow-project-123123/subscriptions/cc-dead-letter-subscription].
05 Run pubsub subscriptions update command (Windows/macOS/Linux) using the ID of the Pub/Sub subscription that you want to reconfigure as identifier parameter, to enable dead lettering for the selected subscription:
gcloud pubsub subscriptions update cc-customer-subscription
--dead-letter-topic=cc-dead-letter-topic
--max-delivery-attempts=10
--dead-letter-topic-project=cc-dataflow-project-123123
06 The command output should return the URL of the reconfigured Pub/Sub subscription:
Updated subscription [projects/cc-dataflow-project-123123/subscriptions/cc-customer-subscription].
07 The Pub/Sub service account for the selected Google Cloud project needs the publisher role to publish dead-lettered messages to the newly created dead-letter topic. To grant Pub/Sub permission to publish messages to the specified topic, run pubsub topics add-iam-policy-binding command (Windows/macOS/Linux). Replace <project-number> with your own GCP project number:
gcloud pubsub topics add-iam-policy-binding cc-dead-letter-topic
--member="serviceAccount:service-<project-number>@gcp-sa-pubsub.iam.gserviceaccount.com"
--role="roles/pubsub.publisher"
08 The command output should return the Google Cloud IAM policy binding metadata:
Updated IAM policy for topic [cc-dead-letter-topic].
bindings:
- members:
- serviceAccount:service-<project-number>@gcp-sa-pubsub.iam.gserviceaccount.com
role: roles/pubsub.publisher
etag: abcdabcdabcd
version: 1
09 The Pub/Sub service account for the selected Google Cloud project needs the subscriber role to forward messages from the reconfigured subscription to the dead-letter topic. To grant Pub/Sub permission to acknowledge forwarded messages and remove them from the specified subscription, run pubsub subscriptions add-iam-policy-binding command (Windows/macOS/Linux). Replace <project-number> with your own GCP project number:
gcloud pubsub subscriptions add-iam-policy-binding cc-customer-subscription
--member="serviceAccount:service-<project-number>@gcp-sa-pubsub.iam.gserviceaccount.com"
--role="roles/pubsub.subscriber"
10 The command output should return the Google Cloud IAM policy binding metadata:
Updated IAM policy for subscription [cc-customer-subscription].
bindings:
- members:
- serviceAccount:service-<project-number>@gcp-sa-pubsub.iam.gserviceaccount.com
role: roles/pubsub.subscriber
etag: abcdabcdabcd
version: 1
11 Repeat steps no. 5 – 10 to enable dead lettering for other Pub/Sub subscriptions created for the selected project.
12 Repeat steps no. 1 – 11 for each GCP project deployed in your Google Cloud account.
Reliability 
Operational