How do I specify a delegated user with Workload Identity Federation via a Service Account

I'm looking to integrated with the Gmail and Admin APIs and want to use a service user with domain-wide delegation to request data on behalf of users in Google Workspaces. My code is running in EC2 in AWS. Reading through the docs it seems best practice is to use workload identity federation to authenticate as a service user so there's no risk of the key being leaked.

I have the following test application code:

```
module.exports = async (req, res) => {
const scopes = [
"https://www.googleapis.com/auth/gmail.readonly",
"https://www.googleapis.com/auth/admin.directory.user.readonly",
];

let status = "";

try {

//Inject the client library config as the GOOGLE_APPLICATION_CREDENTIALS
const configPath = path.join(__dirname, "client_library_config.json");
process.env["GOOGLE_APPLICATION_CREDENTIALS"] = configPath;
process.env["GOOGLE_CLOUD_PROJECT"] = "XXXX";
process.env["AWS_REGION"] = "us-east-1";

const auth = await google.auth.getClient({
scopes,
});

auth.subject = "XXX@XXX.com"; //email of the user I want to impersonate with my service account

const adminAPI = google.admin({ version: "directory_v1", auth });

const user = await adminAPI.users.get({
userKey: "XXX@XXX.com", //email of the user I want to get
});

} catch (err) {
console.log("error", err);
}
res.status(200).json({
status: "ok",
});
};
```

When I run this code I get `Not Authorized to access this resource/api`, but when I run the code locally with a private key and JWT authentication for the service user it works perfectly and I don't run into any issues.

From what I've seen online I need to specify the user I want to impersonate (like this example in [Google's docs](https://developers.google.com/identity/protocols/oauth2/service-account) in Python), but I don't see a way in the node library to specify a user to impersonate using Oauth2.0, just with JWT. How can I specify the user to impersonate using Workload Identity Federation via a service account?