Can we use the default service account of a VM in gcp to call api's?

Question

I am trying to list the Storage Buckets within an Organization using REST API. I am running this code in a VM, currently I created a user managed Service Account and passing its key as a credential in the code.

Instead of passing the Service Account key as a credential:

1. Can i use the service account of the VM to list the Storage Buckets in an Organization?
2. How can we configure the code to use the VM service account?

Answer 1

On your VM you can define the service account that you want to use. By doing this, you configure the metadata server that run behind your VM.

The Client Libraries knows how to leverage the metadata server information. For that, you have nothing special to do, simply get the default configuration (usually like that storage.Client()).

Then, you have to grant that service account at the Organization level (on the console select the org id, and go to IAM to grant your service account).