A third‑party app on a new Compute Engine VM must access installation files in Cloud Storage while other VMs must not. What should you do?

Creating a new service account, attaching it to the VM, and granting specific Cloud Storage permissions is the most secure and granular approach. This follows the principle of least privilege, ensuring only the necessary VM has access to the Cloud Storage files. The Compute Engine default service account often has broad permissions, which is not ideal for a single application requiring specific access, and modifying its permissions could inadvertently affect other VMs. Adding metadata to Cloud Storage objects does not control access; it's used for object categorization or information, not security.