thanks for you help. I ended up with

// somewhere in index.ts
let serviceAccount: TypeOfServiceAccount;
export let serviceAccountPrivateKey = pulumi.Output("");

if (config.createServiceAccount) {
  serviceAccount = new TypeOfServiceAccount(...)
  const serviceAccountKey = new ...
  serviceAccountPrivateKey = serviceAccountKey.PrivateKey
}

So serviceAccount and serviceAccountPrivateKey are global vars and can be used later, private key is exported during declaration, serviceAccountKey is local var in

if

block cause I don't need it elsewhere