Getting a VM instance identity document

Written by

Updated at March 7, 2025

When you create a VM, an identity document that stores information about the VM is generated. It contains the IDs of the VM instance, Marketplace product, disk image, etc.

To request an identity document:

Connect to the VM:
```
ssh <VM_IP_address>
```

Run this command to get the identity document in Google Compute Engine format:

curl \
  --header Metadata-Flavor:Google 169.254.169.254/computeMetadata/v1/instance/vendor/identity/document

Response example:

{"instanceId":"fhmm5252k8vl********","productCodes":null,"imageId":"fd8evlqsgg4e********","productIds":["f2e3ia802lab********"],"createdAt":"2023-05-29T09:46:59Z","version":"2023-03-01"}

Note

If you created your VM before June 9, 2023, and you cannot get its identity document, stop and restart the VM.

Checking identity document signature

Apart from the identity document itself, the VM instance metadata service provides its cryptographic signatures.

You can use these signatures to verify the document's origin, validity, and integrity. To do this:

RSA

DSA

Base64

Connect to the VM:
```
ssh <VM_IP_address>
```

Get an RSA signature from the VM metadata and save it to a file named rsa2048:

curl \
  --header Metadata-Flavor:Google 169.254.169.254/computeMetadata/v1/instance/vendor/identity/rsa > rsa2048

Create a file named certificate and add a public certificate to it:

Verify the signature and save the contents of the document to a file named document:
```
openssl smime -verify -in rsa2048 -inform PEM -certfile certificate -noverify | tee document
```
If the signature is valid, you will see a message saying Verification successful.

Connect to the VM:
```
ssh <VM_IP_address>
```

Get a signature from the VM metadata and save it to a file named dsa2048:

curl \
  --header Metadata-Flavor:Google 169.254.169.254/computeMetadata/v1/instance/vendor/identity/dsa > dsa2048

Create a certificate file and save a public certificate to it:

Verify the signature and save the contents of the document to a file named document:
```
openssl smime -verify -in dsa2048 -inform PEM -certfile certificate -noverify | tee document
```
If the signature is valid, you will see a message saying Verification successful.

Connect to the VM:
```
ssh <VM_IP_address>
```

Get a base64 signature from the VM metadata and save it to a file named signature:

curl \
  --header Metadata-Flavor:Google 169.254.169.254/computeMetadata/v1/instance/vendor/identity/base64 | \
    base64 -d >> signature

Get an identity document and save it to a file named document:

curl \
  --header Metadata-Flavor:Google 169.254.169.254/computeMetadata/v1/instance/vendor/identity/document > document

Create a certificate file and save a public certificate to it:

Extract a public key from the certificate and save it to a file named key:
```
openssl x509 -pubkey -noout -in certificate >> key
```
Verify the signature and save the contents of the document to a file named document:
```
openssl dgst -sha256 -verify key -signature signature document
```
If the signature is valid, you will see a message saying Verified OK.

Map the identity document from the VM metadata to the document saved to the file:

curl http://169.254.169.254/latest/vendor/instance-identity/document | \
openssl dgst -sha256

openssl dgst -sha256 < document

If they have the same hash, the identity document saved to the file matches the document from the VM metadata.

Getting a VM instance identity document

Checking identity document signatureChecking identity document signature

Was the article helpful?

Checking identity document signature