Your company has launched a social media app named ‘Pony’, which consists of multiple sub-applications deployed on Compute Engine within the same GCP project. What is the best method to assign specific permissions to each instance that interacts with Google Cloud APIs?