aa363691_leged_Installation___Nik_Patel__2
[0] Content Web Application App Pool Account(e.g. sp_defaultwebapp) [1] Specify this account as Web Application Pool while creating Web Applications from Manage Web Applications page from Central Admin Application Pool identity to run the IIS Site hosting the SharePoint Content Web Applications and SharePoint Site Collections as the IIS worker process. Please note that both Service Application App Pool and Web Application App Pool accounts behaves same. It is best practice to run all the content web applications in their dedicated application pool account. Log in to the SharePoint Server using farm account to configure Content web applications [3] None [4] None [5] Service Accounts in Central Admin Changes – This account is added as Web Application Pool Account for Content Web Applications in the Configure Service Accounts page. AD Group Membership Changes – After you create the SharePoint Web Application, following machine-level permission is configured automatically: Member in the WSS_WPG Member in the built-in IIS_IUSRS on IIS 7 (Windows Server 2008) and IIS 7.5 (Windows Server 2008 R2), IIS_IUSRs replaces earlier version built-in group, IIS_WPG SQL Database Changes – After you create the SharePoint Web Application, following SQL Server and database permissions for this account are configured automatically: This account is assigned to the db_owner role for the Web application content databases. This account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the farm configuration database. This account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the SharePoint_Admin content database. This account will be assigned to the db_owner role for the associated user profile service application databases (e.g. Profile DB, Sync DB, and Social DB) It is important to note that this account doesn’t have access to the other service application databases like Managed Metadata or Search Service Application DBs [2] 
Must be Domain User Account. Must register as SharePoint Managed Account.
SharePoint 2010 Service Account References for Least-Privileged Installation | Nik Patel
2