title: Assigning scopes to a gcloud service account
body: <p>I am trying to add an extra Service Account to a GCE instance (Google Cloud VM), so that the tools running there can switch between the default Service Account assigned to VM by GCloud and another one, that belongs to a different project. It is clear from the documentation how I can assign scopes to the default account (available in VM settings when it's powered off). But I can not understand how I can set the scopes for the Service Account added manually:</p>
  
  <pre><code>gcloud auth activate-service-account --key-file=myaccount.json
  </code></pre>
  
  <p>Now the account appears in <code>gcloud auth list</code>, but it is unclear which scopes are assigned to it. Another way is to use <a href="https://cloud.google.com/sdk/gcloud/reference/auth/application-default/login" rel="nofollow noreferrer"><code>gcloud auth application-default login</code></a> which has <code>--scopes</code> parameter, but I understand it is not possible to use with service accounts.</p>
  
  <p>Google Cloud <a href="https://cloud.google.com/sdk/gcloud/reference/auth/login" rel="nofollow noreferrer">documentation</a> tells me to </p>
  
  <blockquote>
    <p>create a service account with the appropriate scopes using the Google Cloud Platform Console</p>
  </blockquote>
  
  <p>but I can't find any option to add <strong>Scopes</strong> to a Service Account, only Roles which is possible via IAM. Does anyone know how I can assign scopes to my custom Service Account?</p>