Ensure that instances are not configured to use the default service account

resource "google_compute_instance" "custom" {
  name         = "custom-instance"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

+  service_account {
+    email  = google_service_account.custom.email
+    ...
+  }
}

+ resource "google_service_account" "custom" {
+  account_id   = "custom-service-account"
+  display_name = "Custom Service Account"
+ }