Fetch-url-http-3a-2f-2fmetadata.google.internal-2fcomputemetadata-2fv1-2finstance-2fservice Accounts-2f

The metadata server is not a standard network service. It is implemented inside the hypervisor or guest kernel driver. Traffic to 169.254.169.254 never leaves the physical host. The hypervisor injects signed tokens directly into the VM, trusting only the internal vNIC. This design prevents even root in the guest from stealing the long-term private key – they can only request time-limited tokens.

Your keyword fetch-url-http-3A-2F-2F... is a typical example of a URL that was mistakenly encoded twice. Always decode before use:

If you have ever peeked under the hood of a Google Compute Engine (GCE) virtual machine, you might have stumbled upon a curious HTTP request: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/. It looks cryptic, but it is one of the most powerful and security-critical endpoints in Google Cloud.

This article breaks down what this URL is, why it exists, and how it enables applications to authenticate securely without hard-coded keys.

The string you provided—once URL-decoded—translates to: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/ The metadata server is not a standard network service

This is the Google Cloud Metadata Server. Every Virtual Machine (VM) on Google Compute Engine has access to this internal HTTP endpoint. It is not accessible from the public internet; it only exists inside the Google Cloud network.

The specific path /instance/service-accounts/ is where your VM goes to find out who it is.

The metadata server received the request. In modern Google Cloud environments, there is a final safeguard: the metadata server requires a specific HTTP header (Metadata-Flavor: Google) to prove the request is legitimate and not a spoofed attack.

Zero's initial attempt failed because they didn't know about the header. But the attempt was logged. Without this header, the server responds with a

The server logs captured the event. Because the logging system was set to record the input parameters exactly as they were received, it didn't store the decoded URL. It stored the raw, ugly input string.

The log entry read: ERROR: Request failed for fetch-url-http-3A-2F-2Fmetadata.google.internal-2FcomputeMetadata-2Fv1-2Finstance-2Fservice-accounts-2F

Crucially, all requests to the metadata server must include the header:

Metadata-Flavor: Google

Without this header, the server responds with a 403 Forbidden error. This prevents accidental or malicious cross-site request forgery (CSRF) from external websites. "default": "email": "default@<project-id>

The response from the metadata server will be a JSON object containing information about the service accounts associated with your instance:

  "default": 
    "email": "default@<project-id>.iam.gserviceaccount.com",
    "scopes": [
      "https://www.googleapis.com/auth/cloud-platform",
      "https://www.googleapis.com/auth/userinfo.email"
    ]

In this response:

In traditional cloud setups, you might download a JSON private key file and store it on the VM. That key becomes a liability: if the VM is compromised, the key is stolen.

With the metadata server: