{"record":{"id":"35a5f728db57cb6c","repo":"gravitational/teleport","slug":"failed-to-get-aws-identity-when-checking-a-databas","errorCode":null,"errorMessage":"Failed to get AWS identity when checking a database created by the discovery service","messagePattern":"Failed to get AWS identity when checking a database created by the discovery service","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/srv/db/cloud/resource_checker_credentials.go","lineNumber":92,"sourceCode":"\tswitch {\n\tcase database.IsAWSHosted():\n\t\tc.checkAWS(ctx, database)\n\tcase database.IsAzure():\n\t\tc.checkAzure(ctx, database)\n\tdefault:\n\t\tc.logger.DebugContext(ctx, \"Database has unknown cloud type\",\n\t\t\t\"database\", database.GetName(),\n\t\t\t\"cloud_type\", database.GetType(),\n\t\t)\n\t}\n\treturn nil\n}\n\nfunc (c *credentialsChecker) checkAWS(ctx context.Context, database types.Database) {\n\tmeta := database.GetAWS()\n\tidentity, err := c.getAWSIdentity(ctx, &meta)\n\tif err != nil {\n\t\tc.warn(ctx, \"Failed to get AWS identity when checking a database created by the discovery service\",\n\t\t\t\"database\", database.GetName(),\n\t\t)\n\t\treturn\n\t}\n\n\tif meta.AccountID != \"\" && meta.AccountID != identity.GetAccountID() {\n\t\tc.warn(ctx,\n\t\t\t\"The database agent's identity and discovered database have different AWS account IDs\",\n\t\t\t\"database\", database.GetName(),\n\t\t\t\"agent_account_id\", identity.GetAccountID(),\n\t\t\t\"discovered_account_id\", meta.AccountID,\n\t\t)\n\t\treturn\n\t}\n}\n\n// getAWSIdentity returns the identity used to access the given database,\n// that is either the agent's identity or the database's configured assume-role.","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/db/cloud/resource_checker_credentials.go#L74-L110","documentation":"Warning (not a hard failure) emitted by the discovery/credentials checker: calling GetCallerIdentity/STS with the database agent's configured AWS credentials failed, so subsequent cross-account checks for AWS-hosted discovered databases cannot be performed.","triggerScenarios":"Thrown at lib/srv/db/cloud/resource_checker_credentials.go:92 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the discovery/database agent's AWS credentials (IAM role/user, IRSA, or EC2 instance profile) are valid and not expired","Ensure the identity has permission to call sts:GetCallerIdentity","Check AWS region and network connectivity to the STS endpoint"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}