If I create custom service account with limited permissions, can I set this new service account to be the Application Default Credential?
By default inside app engine