import requests


def get_identity_token(scopes='https://www.googleapis.com/auth/cloud-platform'):
    """
    Getting an identity token from a google authorization service.

    :param scopes: https://cloud.google.com/deployment-manager/docs/reference/latest/authorization
    :return: bearer token
    """
    host = 'http://metadata.google.internal'
    url = f'{host}/computeMetadata/v1/instance/service-accounts/default/token?scopes={scopes}'

    response = requests.get(url=url, headers={'Metadata-Flavor': 'Google'})
    response.raise_for_status()
    # we are always quicker than the lifetime of the token an therefore skip checking expired_in and token_type
    return response.json()['access_token']