Response (JSON):
Keep in mind that the metadata server is only accessible from within the instance, so you don't need to worry about external access. However, it's essential to ensure that your application handles the service account credentials securely and doesn't expose them to unauthorized parties.
This is the . Every Virtual Machine (VM) on Google Compute Engine has access to this internal HTTP endpoint. It is not accessible from the public internet; it only exists inside the Google Cloud network.
import urllib.request import json import google.auth.transport.requests import google.oauth2.id_token
It stores information about the instance, including service accounts, custom metadata, project-level data, and hostnames. The server acts as a local repository for authorized applications, ensuring that keys never need to be stored on the disk. The Service Accounts Endpoint Explained
"email": "your-service-account-email@your-project.iam.gserviceaccount.com", "aliases": [ "your-service-account-email@your-project.iam.gserviceaccount.com", "your-project:your-service-account-email" ], "scope": "https://www.googleapis.com/auth/cloud-platform"
Understanding how this endpoint works is fundamental both for cloud engineering teams who use it for legitimate application authorization and for application security teams defending against Server-Side Request Forgery (SSRF) vulnerabilities. What is the GCP Instance Metadata Server?
For the service account, the full URL is:
Let’s walk through the path:
/computeMetadata/v1/instance/service-accounts/
When you attach a service account to a VM, the metadata server generates an endpoint to manage it. This endpoint allows you to retrieve the email address of the default service account, its aliases, and—the main goal—the access tokens. A. Core Endpoints http://google.internal Default Service Account Details: http://google.internal Default Service Account Token: http://google.internal B. The Metadata-Flavor Header
If you are trying to for this, let me know the programming language you're using so I can provide a copy-pasteable example!
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/
import requests url = "http://google.internal" headers = "Metadata-Flavor": "Google" response = requests.get(url, headers=headers) access_token = response.json()['access_token'] Use code with caution. Copied to clipboard 4. Security Best Practices
Understanding what each component of this string does highlights why it is a prime target for cloud penetration testing and exploitation. 1. The fetch-url= Parameter
