When you create a new Compute Engine instance without specifying a service account, it automatically uses the Compute Engine default service account.

What primitive IAM role is granted to this default service account by default?

The Compute Engine default service account (`[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`) is automatically created in your project and, by default, is granted the primitive `Editor` role. Because this grants broad access to modify almost any resource in the project, best practices dictate creating custom service accounts with least privilege instead of using the default one.