User-managed

If you don't already have a user-managed service account, create a service account.For detailed instruction, seeSet up a service account.

Default

If you are familiar with the Compute Engine default serviceaccount and want to use the credentials provided by the default serviceaccount instead of creating new service accounts, you can grantIAM roles to the default service account.

Before you assign IAM roles to the default service account,note that:

• Granting an IAM role to the default service accountaffects all VMs that are running as the default service account.For example, if you grant the default service account theroles/storage.objectAdmin role, all VMs running as the default serviceaccount with the required access scopes will have permissions granted bytheroles/storage.objectAdmin role.Likewise, if you limit access by omitting certain roles, this affectsall VMs running as the default service account.

• Depending on your organization policy configuration, the default service account might automatically be granted theEditor role on your project. We strongly recommend that you disable the automatic role grant by enforcing theiam.automaticIamGrantsForDefaultServiceAccounts organization policy constraint. If you created your organization after May 3, 2024, this constraint is enforced by default.

  If you disable the automatic role grant, you must decide which roles to grant to the default service accounts, and thengrant these roles yourself.

  If the default service account already has the Editor role, we recommend that you replace the Editor role with less permissive roles.To safely modify the service account's roles, usePolicy Simulator to see the impact of the change, and thengrant and revoke the appropriate roles.

If you are unsure about granting IAM roles to the default service account,create a new user-managed service account instead.

Console

1. Go to theVM instances page.

   Go to VM instances

2. Click the VM instance name for which you want to change the service account.

3. ClickstopStop. If there isnoStop option, clickmore_vertMore actions >stopStop.Wait for the VM to be stopped.

4. ClickEdit.

5. Scroll down to theService Account section.

6. From the drop-down list, select the service account to assign to theVM.

   • If you choose a user-managed service account, the VM's access scopedefaults to the recommendedcloud-platform scope. If you need adifferent scope for your user-managed service account,use the gcloud CLI or Compute Engine API to attach the serviceaccount.
   • If you choose the Compute Engine default service account, you canmodify its access scopes in the Google Cloud console.
     • To change scopes, in theAccess scopes section, selectSetaccess for each API and set the appropriate scopes for yourneeds.
     • Recommended If you're not sure of the proper access scopesto set, chooseAllow full access to all Cloud APIs and thenmake sure torestrict access by setting IAM roles on the service account.

7. ClickSave to save your changes.

8. ClickStart/Resume to restart the VM.

gcloud

1. Stop the VM by using theinstances stop command.ReplaceVM_NAME with the name of your VM instance.

   gcloud compute instances stopVM_NAME

2. Attach the service account. To attach the service account, use theinstances set-service-account commandand provide the VM name, the service account email, and the desiredscopes. For more information about setting access scopes, seeBest practices.

   gcloud compute instances set-service-accountVM_NAME \  --service-account=SERVICE_ACCOUNT_EMAIL \  --scopes=SCOPES

   Replace the following:

   • SERVICE_ACCOUNT_EMAIL: the email address forthe service account that you created.For example:my-sa-123@my-project-123.iam.gserviceaccount.com. Toview the email address, seeListing service accounts.

     If you want to remove the service account from the VM, use the--no-service-account flag.

   • VM_NAME: the name of the VM instance.

   • SCOPES: a comma-separated list ofscope URIs or aliasesprovided in the description for the--scopes flag.

     If you want to remove all scopes for the VM, use the--no-scopes flaginstead.

   For example, the following command assigns the service accountmy-sa-123@my-project-123.iam.gserviceaccount.com to a VM calledexample-instance and sets access scopes on that VM to allowread/write access to Compute Engine and read-only access toCloud Storage:

   gcloud compute instances set-service-account example-instance \  --service-account=my-sa-123@my-project-123.iam.gserviceaccount.com \  --scopes=compute-rw,storage-ro

3. Start the VM by using theinstances start command.ReplaceVM_NAME with the name of your VM instance.

   gcloud compute instances startVM_NAME

REST

1. Stop the VM by making aPOST request using theinstances.stop method:

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME/stop

   Replace the following:

   • PROJECT_ID: the project your VM is in
   • ZONE: the zone where your VM is located
   • VM_NAME: the name of the VM you want to stop

2. Attach the service account by making aPOST request to thesetServiceAccount method:

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME/setServiceAccount{  "email": "SERVICE_ACCOUNT_EMAIL",  "scopes": [    "SCOPE_URI",    "SCOPE_URI",    ...  ]}

   Replace the following:

   • PROJECT_ID: the project ID for this request.
   • ZONE: the zone where this VM belongs to.
   • VM_NAME: the name of the VM.
   • SERVICE_ACCOUNT_EMAIL: the email address forthe service account that you created.For example:my-sa-123@my-project-123.iam.gserviceaccount.com. Toview the email address, seeListing service accounts.
   • SCOPE_URI: the requiredscope URI.

   For example, the following request uses the service accountemailmy-sa-123@my-project-123.iam.gserviceaccount.com and sets aCloud Storage and BigQuery scope:

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME/setServiceAccount{  "email": "my-sa-123@my-project-123.iam.gserviceaccount.com",  "scopes": [    "https://www.googleapis.com/auth/bigquery",    "https://www.googleapis.com/auth/devstorage.read_only"  ]}

3. Start the VM by constructing aPOST request using theinstances.start method:

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME/start

   Replace the following:

   • PROJECT_ID: the project your VM is in
   • ZONE: the zone where your VM is located
   • VM_NAME: the name of the VM you want to start

console

1. Go to theVM instances page.

   Go to VM instances

2. Click the VM instance name for which you want to change the service account.

3. Go to theAPI and identity management section. This sections displaysthe service account and access scope that is used by the VM.

gcloud

Run thegcloud compute instances describe command:

gcloud compute instances describeVM_NAME \    --format json

The output is similar to the following:

{  ...  "serviceAccounts":[      {        "email":"123845678986-compute@developer.gserviceaccount.com",        "scopes":[            "https://www.googleapis.com/auth/devstorage.full_control"        ]      }  ]  ...   }

If the VM isn't using a service account, you receive a responsewithout theserviceAccounts property.

Metadata Server

Query themetadata server from within the VMitself. Make a request tohttp://metadata.google.internal/computeMetadata/v1/instance/service-accounts/:

user@myinst:~$curl "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/" \-H "Metadata-Flavor: Google"

If you enabled one or more service accounts when you created the instance,thiscurl command returns output similar to the following:

123845678986-compute@developer.gserviceaccount.com/default/

If the instance isn't using a service account, you receive an emptyresponse.