A computer-implemented method, the method comprising: associating, by a metadata server, one or more of a plurality of user-specified metadata key-value pairs for configuring a plurality of virtual machine instances, with one or more respective identifiers of a plurality of identifiers, wherein each identifier is one of a project identifier, a tag identifier or an instance identifier, each metadata key-value pair specifying a metadata key that identifies a setting of the virtual machine instances and a metadata value that specifies a value for the setting to be used to configure the virtual machine instances; wherein each identifier corresponds to a collection of metadata key-value pairs of the one or more of the plurality of user-specified metadata key-value pairs; receiving, by the metadata server from a virtual machine instance (110, 112, 114) executing in a multi-tenant system, a metadata query, obtaining, by the metadata server, identifier information associated with the virtual machine instance, wherein the identifier information specifies two or more identifiers of the plurality of identifiers, identifying, by the metadata server, based on identifier information associated with a virtual machine instance (110, 112, 114), one or more user-specified metadata key-value pairs that are each associated with at least one of the two or more identifiers specified by the identifier information associated with the virtual machine instance, the one or more metadata key-value pairs being key-value pairs to be provided to the virtual machine instance, wherein access to the key-value pairs to be provided to the virtual machine instance is restricted to the virtual machine instance and other virtual machine instances that are also associated with the at least one of the two or more identifiers; and providing, by the metadata server to the virtual machine instance, the identified one or more metadata key-value pairs in response to receiving the metadata query, wherein the virtual machine instance configures itself using each metadata key-value pair of the identified one or more metadata key-value pairs by updating a setting, for the virtual machine instance, corresponding to the metadata key of each of the metadata key-value pairs with a value identified by the value of the identified one or more metadata key-value pairs. associating, by a metadata server, one or more of a plurality of user-specified metadata key-value pairs for configuring a plurality of virtual machine instances, with one or more respective identifiers of a plurality of identifiers, wherein each identifier is one of a project identifier, a tag identifier or an instance identifier, each metadata key-value pair specifying a metadata key that identifies a setting of the virtual machine instances and a metadata value that specifies a value for the setting to be used to configure the virtual machine instances; wherein each identifier corresponds to a collection of metadata key-value pairs of the one or more of the plurality of user-specified metadata key-value pairs; wherein each identifier is one of a project identifier, a tag identifier or an instance identifier, each metadata key-value pair specifying a metadata key that identifies a setting of the virtual machine instances and a metadata value that specifies a value for the setting to be used to configure the virtual machine instances; wherein each identifier corresponds to a collection of metadata key-value pairs of the one or more of the plurality of user-specified metadata key-value pairs; receiving, by the metadata server from a virtual machine instance (110, 112, 114) executing in a multi-tenant system, a metadata query, obtaining, by the metadata server, identifier information associated with the virtual machine instance, wherein the identifier information specifies two or more identifiers of the plurality of identifiers, identifying, by the metadata server, based on identifier information associated with a virtual machine instance (110, 112, 114), one or more user-specified metadata key-value pairs that are each associated with at least one of the two or more identifiers specified by the identifier information associated with the virtual machine instance, the one or more metadata key-value pairs being key-value pairs to be provided to the virtual machine instance, wherein access to the key-value pairs to be provided to the virtual machine instance is restricted to the virtual machine instance and other virtual machine instances that are also associated with the at least one of the two or more identifiers; and providing, by the metadata server to the virtual machine instance, the identified one or more metadata key-value pairs in response to receiving the metadata query, wherein the virtual machine instance configures itself using each metadata key-value pair of the identified one or more metadata key-value pairs by updating a setting, for the virtual machine instance, corresponding to the metadata key of each of the metadata key-value pairs with a value identified by the value of the identified one or more metadata key-value pairs.