Access to VM instance metadata

The metadata service allows you to read metadata from both outside and inside VM instances.

Accessing metadata from outside the VM instanceAccessing metadata from outside the VM instance

You can access VM instance metadata from the outside using the following Yandex Cloud tools: the management console, CLI, Terraform, and API.

This method provides access to all metadata folders as well as some keys in them:

• In the computeMetadata folder, only the keys in /instance/attributes/* are readable.
• The user-data folder is fully readable.

Accessing metadata from inside the VM instanceAccessing metadata from inside the VM instance

You can directly access the VM metadata from within the VM. This method provides access to all the metadata folders as well as all the keys inside them.

You can get direct access (without authentication) to metadata from inside the VM through a special metadata service. The metadata service inside the VM instance is available at http://169.254.169.254.

All authenticated VM users can access the metadata service without any restrictions. You cannot restrict an individual VM user's access to metadata.

You can test the metadata service using cURL by first connecting to the VM via the ssh protocol:

curl \
  --header Metadata-Flavor:Google \
  169.254.169.254

The metadata service will respond with a list of available metadata versions, for example:

1.0
2007-01-19
2007-03-01
...
2023-02-15
2023-05-10
latest

We recommend always using the latest metadata version.

For more information on getting metadata from inside the VM instance, see Examples of requests to the metadata service from inside the VM instance.

See alsoSee also

• Getting VM instance metadata
• VM metadata
• Metadata folders
• Keys processed in public images Yandex Cloud
• Transferring metadata to VM instances
• Identity document