{"record":{"id":"520974b3831543e8","repo":"gravitational/teleport","slug":"the-discovered-database-is-in-a-subscription-that","errorCode":null,"errorMessage":"The discovered database is in a subscription that the database agent does not have access to","messagePattern":"The discovered database is in a subscription that the database agent does not have access to","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/srv/db/cloud/resource_checker_credentials.go","lineNumber":155,"sourceCode":"\tif err != nil {\n\t\tc.warn(ctx, \"Failed to get Azure subscription IDs when checking a database created by the discovery service\",\n\t\t\t\"error\", err,\n\t\t\t\"database\", database.GetName(),\n\t\t)\n\t\treturn\n\t}\n\n\trid, err := arm.ParseResourceID(database.GetAzure().ResourceID)\n\tif err != nil {\n\t\tc.logger.WarnContext(ctx, \"Failed to parse resource ID of database\",\n\t\t\t\"database\", database.GetName(),\n\t\t\t\"error\", err,\n\t\t)\n\t\treturn\n\t}\n\n\tif !slices.Contains(allSubIDs, rid.SubscriptionID) {\n\t\tc.warn(ctx, \"The discovered database is in a subscription that the database agent does not have access to\",\n\t\t\t\"database\", database.GetName(),\n\t\t\t\"subscription\", rid.SubscriptionID,\n\t\t)\n\t\treturn\n\t}\n}\n\nfunc (c *credentialsChecker) warn(ctx context.Context, msg string, args ...any) {\n\tlogger := c.logger.With(\n\t\t\"help_message\", `You can update \"db_service.resources\" section of this agent's config file to filter out unwanted resources (see https://goteleport.com/docs/reference/agent-services/database-access-reference/configuration/ for more details). If this database is intended to be handled by this agent, please verify that valid cloud credentials are configured for the agent.`,\n\t)\n\n\tif c.isWildcardMatcher() {\n\t\t//nolint:sloglint // The passed in message and args trips up the linter\n\t\tlogger.WarnContext(ctx, msg, args...)\n\t\treturn\n\t}\n","sourceCodeStart":137,"sourceCodeEnd":173,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/db/cloud/resource_checker_credentials.go#L137-L173","documentation":"Warning emitted when a discovered Azure database's resource ID belongs to a subscription that is not among the subscriptions the database agent's credentials can access; connections to that database will fail.","triggerScenarios":"Thrown at lib/srv/db/cloud/resource_checker_credentials.go:155 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Grant the agent's Azure credentials access to the database's subscription","Or restrict discovery to only the subscriptions the credentials can access"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}