{"id":"gce-metadata-host-local-always-accessible-with-rotation","text":"The GCE metadata server is always accessible regardless of firewall rules, never routes requests off the physical host, but HTTPS access requires client certificate rotation every 7 days — security depends on timely credential refresh, not network controls.","truth_value":"IN","source":"","source_url":"","source_hash":"","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"gce-metadata-host-local-always-accessible-with-rotation","truth_value":"IN","reason":"premise"}]}}