You will have several applications running on different Compute Engine instances in the same project. You want to specify at a more granular level the service account each instance uses when calling Google Cloud APIs. What should you do?

The standard and most direct method to assign a specific identity to a Compute Engine instance is by specifying a service account during its creation. This allows each instance to have its own granular set of permissions for calling Google Cloud APIs, which is a best practice for implementing the principle of least privilege. The instance's applications can then transparently acquire credentials for this attached service account from the instance metadata server without needing to manage private keys.

B. Assigning a service account name as instance metadata is merely adding a label; it does not configure the instance's actual identity for API authentication.
C. A service account cannot be changed while an instance is running. Furthermore, the gcloud compute instances update command is not used for this purpose.
D. This option is incorrect for two reasons: instance metadata does not confer identity, and the service account cannot be modified on a running instance.

1. Google Cloud Documentation

Compute Engine

"Create and enable service accounts for instances": "When you create a new instance

you can specify a service account that the instance will use for authentication... To specify a service account when you create an instance

use the --service-account flag." This directly supports specifying the service account at creation time.

Source: cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances (See section: "Creating an instance that uses a user-managed service account").

2. Google Cloud SDK Documentation

gcloud compute instances create: The command reference explicitly lists the --service-account flag. The description states: "The service account to be used by this instance... If not specified

the project default service account is used." This confirms the mechanism for option A.

Source: cloud.google.com/sdk/gcloud/reference/compute/instances/create (See flag: --service-account).

3. Google Cloud Documentation

Compute Engine

"Changing the service account and access scopes for an instance": "To change an instance's service account or access scopes

you must temporarily stop the instance." This directly refutes options C and D

which suggest updating a running instance.

Source: cloud.google.com/compute/docs/access/changing-service-account-and-scopes (See the "Before you begin" section).

4. Google Cloud Documentation

Compute Engine

"Storing and retrieving instance metadata": This document explains that the metadata server provides credentials for the service account attached to the instance. It does not state that setting a custom metadata key-value pair can define the instance's identity. This invalidates the logic in options B and D.

Source: cloud.google.com/compute/docs/storing-retrieving-metadata (See section: "Default metadata").