A Compute Engine app in project A must authenticate to a Pub/Sub topic in project B. What should you do?

The most secure and recommended approach is to grant the existing service account of the Compute Engine VM in Project A the necessary permissions directly on the Pub/Sub topic in Project B. This leverages Google Cloud's built-in identity and access management (IAM) without exposing credentials. Configuring instances to use a service account from Project B is not practical or secure, as VMs should primarily use service accounts from their own project. Deploying service account keys (JSON files) is generally discouraged due to security risks and management overhead; Application Default Credentials (ADC) should rely on the instance's attached service account. Granting a service account from Project A permissions on the topic is correct, but deploying a key for ADC is unnecessary and less secure than using the default instance service account.