def METHOD_NAME(data):
  """Sign data with the default App Engine service account."""
  iam = googleapiclient.discovery.build('iamcredentials', 'v1')
  service_account = 'projects/-/serviceAccounts/' + utils.service_account_email(
  )
  response = iam.projects().serviceAccounts().signBlob(  # pylint: disable=no-member
      name=service_account,
      body={
          'delegates': [],
          'payload': base64.b64encode(data).decode('utf-8'),
      }).execute()
  try:
    return base64.b64decode(response['signedBlob'])
  except Exception as e:
    raise GcsError('Invalid response: ' + str(e))