diff --git a/cluster/addons/metadata-proxy/gce/metadata-proxy-configmap.yaml b/cluster/addons/metadata-proxy/gce/metadata-proxy-configmap.yaml
index 5be4cbe3b61..af8b8c974b5 100644
--- a/cluster/addons/metadata-proxy/gce/metadata-proxy-configmap.yaml
+++ b/cluster/addons/metadata-proxy/gce/metadata-proxy-configmap.yaml
@@ -23,37 +23,63 @@ data:
 
         # By default, return 403. This protects us from new API versions.
         location / {
-            return 403;
+            return 403 "This metadata API is not allowed by the metadata proxy.";
         }
 
         # Allow for REST discovery.
         location = / {
+            if ($args ~ "recursive=true") {
+                    return 403 "?recursive calls are not allowed by the metadata proxy.";
+            }
             proxy_pass http://169.254.169.254;
         }
         location = /computeMetadata/ {
+            if ($args ~ "recursive=true") {
+                    return 403 "?recursive calls are not allowed by the metadata proxy.";
+            }
             proxy_pass http://169.254.169.254;
         }
 
         # By default, allow the v0.1, v1beta1, and v1 APIs.
         location /0.1/ {
+            if ($args ~ "recursive=true") {
+                    return 403 "?recursive calls are not allowed by the metadata proxy.";
+            }
             proxy_pass http://169.254.169.254;
         }
         location /computeMetadata/v1beta1/ {
+            if ($args ~ "recursive=true") {
+                    return 403 "?recursive calls are not allowed by the metadata proxy.";
+            }
             proxy_pass http://169.254.169.254;
         }
         location /computeMetadata/v1/ {
+            if ($args ~ "recursive=true") {
+                    return 403 "?recursive calls are not allowed by the metadata proxy.";
+            }
             proxy_pass http://169.254.169.254;
         }
 
         # Return a 403 for the kube-env attribute in all allowed API versions.
         location /0.1/meta-data/attributes/kube-env {
-            return 403;
+            return 403 "This metadata endpoint is concealed.";
         }
         location /computeMetadata/v1beta1/instance/attributes/kube-env {
-            return 403;
+            return 403 "This metadata endpoint is concealed.";
         }
         location /computeMetadata/v1/instance/attributes/kube-env {
-            return 403;
+            return 403 "This metadata endpoint is concealed.";
+        }
+
+        # Return a 403 for instance identity in all allowed API versions.
+        location ~ /0.1/meta-data/service-accounts/.+/identity {
+            return 403 "This metadata endpoint is concealed.";
+        }
+        location ~ /computeMetadata/v1beta1/instance/service-accounts/.+/identity {
+            return 403 "This metadata endpoint is concealed.";
+        }
+        location ~ /computeMetadata/v1/instance/service-accounts/.+/identity {
+            return 403 "This metadata endpoint is concealed.";
         }
       }
     }