I'm wondering if I can configure a GAE Flexible "service" to use a specific service account ID instead of the default service account ID, which all services run as.
Why? I want to isolate each service's permissions, but also simplify the service code by allowing it to still use the Application Default credentials method of calling Google APIs.
Is there an app.yaml configuration/environment variable where I can control this?
I didn't see the answer here https://cloud.google.com/appengine/docs/flexible/java/migrating or https://cloud.google.com/appengine/docs/flexible/java/authorizing-apps
I also found this https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#using which tells me how to do what I want at the compute engine level, but I don't see how to apply it at the GAE Flex managed level.
If this is not possible, what is the next best alternative?
