A Linux VM must use a specific service account (not the Compute Engine default) to connect to Cloud SQL. What should you do?

When creating a VM instance, you can assign a specific service account under "Identity and API access" in the Cloud Console. This securely configures the VM to use the specified service account for API calls, including connecting to Cloud SQL, without needing to manage credentials manually on the VM. Downloading service account JSON keys and storing them in metadata or directly on the VM is generally discouraged for security reasons. Metadata is not designed for sensitive credentials, and storing keys directly on the VM increases the risk of compromise. The compute-engine-service-account metadata key is not a standard or recommended method for configuring service accounts for VMs.