Accounts-2f — Fetch-url-http-3a-2f-2fmetadata.google.internal-2fcomputemetadata-2fv1-2finstance-2fservice

curl -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/

The request traveled over the internet to the company’s load balancer. The load balancer, however, had a rudimentary security guard installed—a Web Application Firewall (WAF). The WAF inspected the incoming text. It saw the words metadata.google.internal and blocked the request immediately. curl -H "Metadata-Flavor: Google" http://metadata

The server turned its head inward. It wasn't looking at the public internet anymore; it was looking at itself. It sent a GET request to its own metadata server. It saw the words metadata

Three hours later, a DevOps engineer named Sarah was sipping coffee and reviewing the error logs. She saw the strange string. It sent a GET request to its own metadata server

No service account is attached to the instance. This can happen if you created a VM with --no-service-account . Fix: Stop the VM, edit its configuration to attach a service account, and restart.