When you create an instance using the gcloud command-line tool or the Google Cloud Console, you can specify which service account the instance uses when calling Google Cloud APIs.
https://cloud.google.com/compute/docs/access/service-
accounts#associating_a_service_account_to_an_instance

Update and create resource is not even a command under deployment management service.
https://cloud.google.com/sdk/gcloud/reference/deployment-manager/deployments/update

Authorizing with a service account
gcloud auth activate-service-account authorizes access using a service account. As with gcloud init and gcloud auth login, this command saves the service account credentials to the local system on successful completion and sets the specified account as the active account in your Cloud SDK configuration.
https://cloud.google.com/sdk/docs/authorizing#authorizing_with_a_service_account

If the rule will have the lowest priority, it will permit inbound traffic/ connections to the VM instance server-2. The large will be the number, the low will be the priority. The lowest priority will ensure that the other rules that match will apply. So, the largest number should be selected to make the priority lowest.