Custom IAM policy binding for a custom service account in GCP

Question

I created a service account mycustomsa@myproject.iam.gserviceaccount.com.

Following the GCP best practices, I would like to use it in order to run a GCE VM n