How can I change the Service Account that my GCP GAE Flex Service is running as?

Question

I'm wondering if I can configure a GAE Flexible "service" to use a specific service account ID instead of the default service account ID, which all services run as.

Why? I want to isolate each service's permissions, but also simplify the service code by allowing it to still use the Application Default credentials method of calling Google APIs.

Is there an app.yaml configuration/environment variable where I can control this?

I didn't see the answer here https://cloud.google.com/appengine/docs/flexible/java/migrating or https://cloud.google.com/appengine/docs/flexible/java/authorizing-apps

I also found this https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#using which tells me how to do what I want at the compute engine level, but I don't see how to apply it at the GAE Flex managed level.

If this is not possible, what is the next best alternative?

Answer 1

This isn't possible at the moment. The best way to go forward with this would be to open a feature request here.