Question

A Compute Engine VM was created with the default Compute Engine service account, but your security team now requires the VM to use a dedicated service account named 'app-sa@project.iam.gserviceaccount.com' that has only the minimal roles needed. The VM is currently running in production. What is the correct way to change the service account attached to this existing instance?

Accepted Answer

Stop the instance, then run 'gcloud compute instances set-service-account' specifying the new service account and required scopes, and start the instance.

Answer

Update the service account directly with 'gcloud compute instances set-service-account' while the instance is running so there is no downtime.

Answer

Delete the default service account so the VM automatically falls back to using 'app-sa@project.iam.gserviceaccount.com'.

Answer

Grant the 'app-sa' service account the Service Account User role on the default service account so the VM inherits its permissions.