Please add ceph client name to options.
Ceph allows to use different clients (usernames) with different permissions (option '-n'). It is the best practice to use identity with minimal permissions for a given task. Current configuration calls ceph without client name, which implies 'client.admin' client name. Such permission for monitoring service is too wide, IMHO.