my first guess is that the

osqueryd

process isn’t getting credentials from the instance metadata service