Ensure default service accounts having complete cloud access are not used by Google Compute Instance

As with many cloud providers, Google recommends the use of service accounts for automated functions. It is best practice to ensure that these service accounts have access that aligns with the task for which they are used rather than having broad access to many or all services.

In GCP Console -

1. Open the Compute Engine page.
2. Stop the instance.
3. Click on the VM instance tab.
4. Click on Instance to edit.
5. Click on Edit and Go to Access scopes in Identity and API access.
6. Select on Set access for each API.
7. Select the APIs required.
8. Click Save.

In Terraform -

1. In the resource google_compute_instance, ensure that service_account.scopes attribute does not contain cloud-platform.

References:
https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_instance#service_account
https://cloud.google.com/sdk/gcloud/reference/alpha/compute/instances/set-scopes#--scopes