How to restrict/identify/notify sensitive data stored in project metadata of Compute Engine Settings

[gaurav_gupta]

Hi Team,

As we know that we can store any kind of data in PROJECT METADATA(under Compute Engine -- Settings - Metadata) How do we ensure that no sensitive data is stored in project metadata? and even if sensitive data are stored in project metadata, How can we get notified?

Project metadata which are stored in plain-format is accessible to any user or service account with the necessary permissions. If unauthorised individuals gain access to the project or its metadata, they can retrieve the sensitive information, potentially leading to unauthorised access or misuse.

Potential Sensitive metadata can be: GCP SA keys, Certification, Application Password, API keys, ssh private key, Database/VM password etc.

for example

[dionv]

Hello @gaurav_gupta ,

However, any process that can query the metadata URL, has access to all values in the metadata server. This includes any custom metadata values that were written to the server. Google recommends exercising caution when writing sensitive values to the metadata server or when running third-party processes. Attaching here the documentation as reference.