This is the extent of what the metadata server can do

$ SVC_ACCOUNT_URI="http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/"
$ curl ${SVC_ACCOUNT_URI} -H "Metadata-Flavor: Google"
FOOBAR-compute@developer.gserviceaccount.com/
default/
$ DEFAULT="${SVC_ACCOUNT_URI}default/"
$ SPECIFIC="${SVC_ACCOUNT_URI}FOOBAR-compute@developer.gserviceaccount.com/"
$ curl ${DEFAULT} -H "Metadata-Flavor: Google"
aliases
email
scopes
token
$ curl ${SPECIFIC} -H "Metadata-Flavor: Google"
aliases
email
scopes
token
$ curl "${DEFAULT}aliases" -H "Metadata-Flavor: Google"
default
$ curl "${DEFAULT}email" -H "Metadata-Flavor: Google"
FOOBAR-compute@developer.gserviceaccount.com
$ curl "${DEFAULT}scopes" -H "Metadata-Flavor: Google"
https://www.googleapis.com/auth/devstorage.read_only
https://www.googleapis.com/auth/logging.write
https://www.googleapis.com/auth/userinfo.email
$ curl "${DEFAULT}token" -H "Metadata-Flavor: Google"
{"access_token":"ya29.REDACTED","expires_in":3599,"token_type":"Bearer"}

Adding ability to sign URL from Compute Engine Service account #922

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions