Nice! I do currently filter based on username / groups in my firewall policies on my virtualized Linux hosts which has been pretty effective but yes there are s

Nice! I do currently filter based on username / groups in my firewall policies on my virtualized Linux hosts which has been pretty effective but yes there are some places where I've had to give an otherwise unprivileged user the ability to query the metadata service which is not great. In most cases restricting this to root is sufficient.