code: func NewGCETokenProvider(ctx context.Context, account string, scopes []string) (TokenProvider, error) {
  	// Grab an email associated with the account. This must not be failing on
  	// a healthy VM if the account is present. If it does, the metadata server is
  	// broken.
  	email, err := metadata.Get("instance/service-accounts/" + account + "/email")
  	if err != nil {
  		if _, yep := err.(metadata.NotDefinedError); yep {
  			return nil, ErrInsufficientAccess
  		}
  		return nil, err
  	}
  
  	// Ensure account has requested scopes.
  	availableScopes, err := metadata.Scopes(account)
  	if err != nil {
  		return nil, err
  	}
  	availableSet := stringset.NewFromSlice(availableScopes...)
  	for _, requested := range scopes {
  		if !availableSet.Has(requested) {
  			logging.Warningf(ctx, "GCE service account %q doesn't have required scope %q", account, requested)
  			return nil, ErrInsufficientAccess
  		}
  	}
  
  	return &gceTokenProvider{
  		account: account,
  		email:   email,
  		cacheKey: CacheKey{
  			Key:    fmt.Sprintf("gce/%s", account),
  			Scopes: scopes,
  		},
  	}, nil
  }
docs: // NewGCETokenProvider returns TokenProvider that knows how to use GCE metadata server.