How to restrict/identify/notify sensitive data stored in project metadata of Compute Engine Settings

[gaurav_gupta]

Hi Team,

As we know that we can store any kind of data in PROJECT METADATA(under Compute Engine -- Settings - Metadata) How do we ensure that no sensitive data is stored in project metadata? and even if sensitive data are stored in project metadata, How can we get notified?

Project metadata which are stored in plain-format is accessible to any user or service account with the necessary permissions. If unauthorised individuals gain access to the project or its metadata, they can retrieve the sensitive information, potentially leading to unauthorised access or misuse.

Potential Sensitive metadata can be: GCP SA keys, Certification, Application Password, API keys, ssh private key, Database/VM password etc.

for example