The service-accounts/ directory within this server provides information about the IAM service accounts attached to the instance, including their identities and the temporary OAuth 2.0 access tokens required to call other GCP APIs. Key Functionalities of the Endpoint About VM metadata | Compute Engine
If you’ve ever dug through application logs on a Google Cloud instance (like a Compute Engine VM or a Cloud Run container) and seen a fetch-url error containing http://metadata.google.internal... , you might have been confused. Is this a hack? A broken link? Is this a hack
.../default/token : Generates short-lived OAuth 2.0 access tokens used to authenticate to Google Cloud APIs (e.g., Cloud Storage, BigQuery). // This will fail due to double encoding
// This will fail due to double encoding fetch("http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/", headers: "Metadata-Flavor": "Google" ) you might have been confused.
Explicitly block requests to link-local IP addresses like 169.254.169.254 (which the metadata DNS resolves to) and loopback addresses like 127.0.0.1 .