You are deploying a custom application on a Compute Engine VM. The application needs to read configuration files from a specific Cloud Storage bucket.

What is the MOST secure way to grant the VM access to the bucket?

Create a custom service account, grant it the roles/storage.objectViewer role on the bucket, and attach the service account to the VM.

Use the default Compute Engine service account, as it automatically has Editor access to the project.

Generate a JSON key for a service account, store it on the VM, and configure the application to authenticate using the key file.

Make the Cloud Storage bucket public so the VM can read it without authentication.