Fetch-url-http-3a-2f-2fmetadata.google.internal-2fcomputemetadata-2fv1-2finstance-2fservice Accounts-2f Updated Jun 2026

import requests url = "http://google.internal" headers = "Metadata-Flavor": "Google" response = requests.get(url, headers=headers) access_token = response.json()['access_token'] Use code with caution. Copied to clipboard 4. Security Best Practices

The Gateway to Cloud Identity: Understanding the GCP Metadata Server

To help me tailor the implementation, are you building this as a for a cloud application, or are you developing security monitoring/testing tools ? View and query VM metadata | Compute Engine

If you run curl http://metadata.google.internal from your laptop, it will fail because the DNS name resolves to a local link address only within GCP.

All requests to the metadata server include the header: import requests url = "http://google

Example manual caching in Python:

: This URL is only reachable from within a Google Cloud resource; it is not accessible over the public internet.

When decoded, the URL becomes http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/ . This internal endpoint is accessible only from within the GCP environment (e.g., a Compute Engine VM, Cloud Run, or App Engine).

: The internal DNS name for the GCP metadata server, accessible only from within a running VM, Cloud Function, or GKE pod. View and query VM metadata | Compute Engine

"email": "your-service-account-email@your-project-id.iam.gserviceaccount.com", "aliases": [ "default", "your-service-account-email@your-project-id.iam.gserviceaccount.com" ], "scope": "https://www.googleapis.com/auth/cloud-platform"

When working with GCP, it's essential to be aware of the service accounts and their roles in authenticating and authorizing access to resources. By leveraging the metadata server and fetch URL, you can build more secure, scalable, and efficient applications on GCP.

response = requests.get(url, headers=headers) print(response.json())

Assign IAM roles to the service account only for the resources it needs. This internal endpoint is accessible only from within

wget -q --header="Metadata-Flavor: Google" -O - \ "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/"

Accessing Service Account Tokens via GCP Metadata Server: A Deep Dive

Query was small, just a few dozen lines of Python, but he had a very specific job. He lived on a Virtual Machine—a cozy little slice of a server—and his sole purpose in life was to talk to the "Oracle" of the machine: the Metadata Server

Note: The -H "Metadata-Flavor: Google" header is mandatory to prevent Server-Side Request Forgery (SSRF) attacks. 2. Getting the Default Token