An app using Application Default Credentials runs on your laptop and works. You migrate it to a Compute Engine VM and want minimal changes using Google-recommended authentication. What should you do?

The correct approach is to assign appropriate Google service access to the VM's Compute Engine service account. When an application uses Application Default Credentials (ADC) on a Compute Engine VM, ADC automatically uses the VM's attached service account for authentication. By granting the necessary IAM roles to this service account, the application gains the required permissions without code changes or explicit credential management within the application. Creating a new service account and configuring the app to use it is more complex than necessary, as ADC can leverage the existing VM service account. Storing credentials in a config file (either for a service account or a user account) is insecure and not recommended for production environments due to the risk of exposure and the operational overhead of managing these files.