Fetch-url-http-3a-2f-2fmetadata.google.internal-2fcomputemetadata-2fv1-2finstance-2fservice Accounts-2f 90%
Query straightened his brackets and prepared his request. He didn't need to look far; he knew exactly where the Oracle lived. He whispered the sacred string:
Metadata-Flavor: Google
To fetch service account information, you'll need to send a GET request to the metadata server with the appropriate path. Here's an example using curl :
Google requires a specific HTTP header to protect against Server-Side Request Forgery (SSRF) attacks. If a request hits this URL without the header, the server rejects it.
The metadata server is a dedicated, internal service accessible to every GCP virtual machine instance. It provides information about the instance, such as hostname, IP address, project ID, and—most importantly—service account credentials. 169.254.169.254 (link-local) Hostname: metadata.google.internal The server is available only from within the GCP network. 2. Deep Dive: /instance/service-accounts/ Query straightened his brackets and prepared his request
curl -H "Metadata-Flavor: Google" \ "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/"
$ curl -H "Metadata-Flavor: Google" \ "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/"
:
For a non‑default account, replace default with the full email (URL‑encoded if necessary). Here's an example using curl : Google requires
: The server is only accessible from within the instance itself via the internal DNS name metadata.google.internal or the link-local IP 169.254.169.254 . Key Endpoints Under the /service-accounts/ path, you will typically find:
Thus the full decoded URL is:
to retrieve information about a virtual machine's service accounts from the internal metadata server. Google Groups Topic: Querying Google Cloud Metadata Service Accounts Google Compute Engine Metadata Server
Google Cloud strictly requires this header for all /v1/ requests to ensure the request is intentional. It provides information about the instance, such as
Seven thousand miles away, in a dim apartment lit only by the glow of a terminal, an attacker named "Zero" was scanning the company's public-facing infrastructure.
Without this header, the server returns a 403 Forbidden response. This protects against accidental exposure or CSRF‑style attacks from unprivileged processes.
default/ my-service-account@my-project.iam.gserviceaccount.com/