You have an application running on a Compute Engine instance. The application needs to read files from a Cloud Storage bucket. You want to follow security best practices.

How should you grant the application access to the bucket?

Embed your personal user account credentials in the application code.

Create a service account key, download the JSON file to the instance, and set the GOOGLE_APPLICATION_CREDENTIALS environment variable.

Create a custom service account, grant it the 'Storage Object Viewer' role, and attach it to the Compute Engine instance.

Make the Cloud Storage bucket public.