Several applications run on different Compute Engine instances in the same project. You need to control which Service Account each VM uses when calling Google Cloud APIs. What should you do?

The correct approach is to specify the Service Account for each VM during instance creation. This is because the Service Account associated with a Compute Engine instance is a fundamental property that dictates its identity and permissions when interacting with Google Cloud APIs. It cannot be changed after the instance has been created. Setting instance metadata keys to the Service Account name is incorrect because metadata is for custom data, not for configuring the instance's core identity. Updating instances after creation to set a Service Account is not possible, as this property is immutable post-creation. Similarly, adding the Service Account name as instance metadata after creation would not grant the instance the necessary permissions; it would merely be a piece of data.