title: How Google Cloud authenticates default service accounts?
body: <p>I wonder how Google authenticates <a href="https://cloud.google.com/iam/docs/service-accounts#default" rel="nofollow noreferrer">default service accounts</a> in user's projects.</p>
  <p>For instance, I have default service account for compute in my project but it has no associated means for impersonation or authentication (no IAM policy bindings, like iam.ServiceAccounts.getAccessToken, and no keys):</p>
  <pre><code>$ gcloud iam service-accounts list
  DISPLAY NAME                            EMAIL                                               DISABLED
  Compute Engine default service account  502923505097-compute@developer.gserviceaccount.com  False
  
  $ gcloud iam service-accounts get-iam-policy 502923505097-compute@developer.gserviceaccount.com
  etag: ACAB 
  </code></pre>
  <p>There are some bindings inherited from project level. For example there is binding for Compute Engine Service Agent:</p>
  <pre><code>$ gcloud projects get-iam-policy  cedar-lexicon-312307
  bindings:
  - members:
    - serviceAccount:service-502923505097@compute-system.iam.gserviceaccount.com
    role: roles/compute.serviceAgent
  </code></pre>
  <p>Do I understand correctly that Compute Engine Service Agent is authorised to impersonate <em>any</em> service account in my project and is used to impersonate compute's default service account? Are there any other means (may be hidden to users) by which Google Services impersonate default service accounts?</p>